Network Control and Engineering for QoS, Security and Mobility, V: IFIP 19th World Computer Congress,TC-6, 5th IFIP International Conference on Network ... and Communication Technology) (v. 5)

NETWORK CONTROL AND ENGINEERING FOR QoS, SECURITY AND MOBILITY, V

IFIP - The International Federation for Information Processing IFIP was founded in 1960 under the auspices of UNESCO, following the First World Computer Congress held in Paris the previous year. An umbrella organization for societies working in information processing, IFIP's aim is two-fold: to support information processing within its member countries and to encourage technology transfer to developing nations. As its mission statement clearly states, IFIP's mission is to be the leading, truly international, apolitical organization which encourages and assists in the development, exploitation and application of information technology for the benefit of all people. IFIP is a non-profitmaking organization, run almost solely by 2500 volunteers. It operates through a number of technical committees, which organize events and publications. IFIP's events range from an international congress to local seminars, but the most important are; • The IFIP World Computer Congress, held every second year; • Open conferences; • Working conferences. The flagship event is the IFIP World Computer Congress, at which both invited and contributed papers are presented. Contributed papers are rigorously refereed and the rejection rate is high. As with the Congress, participation in the open conferences is open to all and papers may be invited or submitted. Again, submitted papers are stringently refereed. The working conferences are structured differently. They are usually run by a working group and attendance is small and by invitation only. Their purpose is to create an atmosphere conducive to innovation and development. Refereeing is less rigorous and papers are subjected to extensive group discussion. Publications arising from IFIP events vary. The papers presented at the IFIP World Computer Congress and at open conferences are published as conference proceedings, while the results of the working conferences are often published as collections of selected and edited papers. Any national society whose primary activity is in information may apply to become a full member of IFIP, although full membership is restricted to one society per country. Full members are entitled to vote at the annual General Assembly, National societies preferring a less committed involvement may apply for associate or corresponding membership. Associate members enjoy the same benefits as full members, but without voting rights. Corresponding members are not represented in IFIP bodies. Affiliated membership is open to non-national societies, and individual and honorary membership schemes are also offered.

NETWORK CONTROL AND ENGINEERING FOR QoS, SECURITY AND MOBILITY, V IFIP 19th World Computer Congress, TC-6, 5th IFIP International Conference on Network Control and Engineering for QoS, Security and Mobility, August 2025, 2006, Santiago, Chile

Edited by Dominique GaYti Universite de Technologie de Troyes, France

Springer

Library of Congress Control Number: 2006928493 Network Control and Engineering for QoS, Security and Mobility, V Edited by D. Gaiti

p. cm. (IFIP International Federation for Information Processing, a Springer Series in Computer Science)

ISSN: 1571-5736/ 1861-2288 (Internet) ISBN: 10: 0-387-34825-5 ISBN: 13:9780-387-34825-5 elSBN: 10:0-387-34827-1 Printed on acid-free paper

Copyright © 2006 by Internationa! Federation for Information Processing. All rights reserved. This work may not be translated or copied in whole or in part without the written permission of the publisher (Springer Science+Business Media, LLC, 233 Spring Street, New York, NY 10013, USA), except for brief excerpts in connection with reviews or scholarly analysis. Use in connection with any form of information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed is forbidden. The use in this publication of trade names, trademarks, service marks and similar terms, even if they are not identified as such, is not to be taken as an expression of opinion as to whether or not they are subject to proprietary rights. Printed in the United States of America. 9 8 7 6 5 4 3 2 1 springer.com

NETCON 06 A Zero Burst Loss Architecture for star OBS Networks, Xenia Mountrouidou, Vishwas Puttasubbappa, Harry Perros

1

Safeguarding the Transmission of Biometric Measurements Used for Authenticating Individuals, Ernst L. Leiss 19 The risks analysis like a practice of secure software development. A revision of models and methodologies, Jose Carrillo Verdun, Gloria Gasca Hurtado, Edmundo Tovar Caro, Vianca Vega Zepeda 27 P3P Semantic Checker of Site Behaviours, Robson Eduardo Grande, Sergio Donizetti Zorzo 41 A Sliding Window Based Management Traffic Clustering Algorithm for 802.11 WLAN Intrusion Detection, Wenzhe Zhou, Alan Marshall, Qiang Gu 55 Secure SCTP against DoS Attacks in Wireless Internet, Inwhee Joe 65 Design of an Adaptive-Rate Video-Streaming Service vnth Different Classes of Users, /. V. Martin, Monica Aguilar-Igartua, Jorge MataDiaz 75 A Novel Architecture for Utility Driven Management, Issam Aib„ Raouf Boutaba, Guy Pujolle 89 Multiobjective Multicast Routing with Ant Colony Optimization, Diego Pinto, Benjamin Bardn 101 A Survey of Application-level Multicast Group Communication and a Proposal for Intelligent Reflectors, Janine Kniess, Celio Vinicius N. Albuquerque 117 Towards autonomic networking and self-configm-ating routers, Thomas Bullot, Dominique Gaiti

127

Analysis of Individual Flows Performance for Delay Sensitive Applications, Ricardo Nabhen, Edgard Jamhour, Manoel C.Penna, Mauro Fonseca 143

VI

Proportional Service Differentiation with MPLS, Jodo Neves, Paulo Rogerio Pereira, Augusta Casaca 157 A Model of Signaling for Establishing of LSPs for Multicast Conununication over GMPLS Networks, Rafael P. Esteves, Antonio J. G. Abelem,Ewerton Vaz, Michael A. Stanton 171 Agent-Based Self-Management of MPLS DiffServ-TE domain, Rana Rahim-Amoud, Leila Merghem-Boulahia, Dominique Gaiti 187 NSME: A Framework for Network Worm Modeling and Simulation, Siming Lin, Xueqi Cheng 201 Algorithms for network service guarantee under minimal link usage information, Sugwon Hong, Hwang-Kyu Lee, Seonuck Pack 213 Dynamic Complexity of Autonomic Communication and Software Systems, Andrei Kirilyruk, Mikael Salaiin 223

A Zero Burst Loss Architecture for star OBS Networks Xenia Mountrouidou*, Vishwas Puttasubbappa**, Harry Perros* *Computer Science Department, North Carolina State University, Raleigh, NC 27695, USA {pmountr, hp}@csc.ncsu.edu **Ericsson IP Infrastructure, 920 Main Campus Drive, Suite 500 Raleigh, NC 27606, USA [email protected]

Abstract. Performance studies point to the fact that in an OBS network, the link utilization has to be kept very low in order for the burst loss probability to be within an acceptable level. Various congestion control schemes have been proposed, such as the use of converters, fiber delay lines, and deflection routing. However, these schemes do not alleviate this problem. It is our position that in order for OBS to become commercially viable, new schemes have to be devised that will either guarantee zero burst loss, or very low burst loss at high utilization. In a previous paper [Ij, we described effective zero burst loss schemes for OBS rings. In this paper, we present a zero burst loss scheme for star OBS topologies. Further research into the topic is required.

1

Introduction

Optical Burst Switching provides a good solution for transporting bursty traffic in an all optical network. The fundamental unit in an OBS network is a burst: a collection of packets grouped into a size that may vary according to the characteristics of the specific network. The most attractive feature of OBS is that it is all-optical; meaning, there is no OEO conversion of data within the OBS network. This characteristic reduces the overall system cost, but more importantly, offers a high speed and transparent network, independent of technology or data rate. An OBS network consists of end-devices that we refer to as edge nodes. Edge nodes can operate both as transmitters and receivers of bursts. These devices are connected to various electronic packet-switched networks, such as IP, ATM and frame relay, and they also have one or more OBS interfaces. Each edge node is connected to one or more core OBS node which are interconnected through a mesh network. Each core node is an all bufferless optical cross connect (OXC). This means that the burst data are transmitted optically all the way

Please use the following format when citing this chapter: Mountrouidou, X., Puttasubbappa, V., Perros, H., 2006, in IFIP International Federation for Information Processing, Volume 213, Network Control and Engineering for QoS, Security, and Mobility, V, ed. Gaiti, D., (Boston: Springer), pp. 1-18.

2

Xenia Mountrouidou, Vishwas Puttasubbappa and Harry Perros

to their destination. Multiple bursts can be transmitted onto the same fiber simultaneously, since each fiber carries W wavelengths. The main characteristic of an OBS network is the separation between data and control planes. Payload data is received and assembled into data bursts at each source edge node in the electronic domain, transported through one or more optical core nodes in the optical doma.in, and delivered to sink edge nodes where they are converted back to the electronic domain and disassembled into their constituent data packets for delivery to respective data sinks. In order to transmit a burst, a connection has to be established through the buffer less optical network. This is done by sending a control packet (also referred to as the setup packet in this paper) that includes information such as: source address, destination address, and duration of the burst. The control packet is transmitted optically in-band or out-of-band or it is transmitted electronically out-of-band, and it is processed by each core node electronically. Another feature that distinguishes an OBS network from any other optical network is that the transmission of data is performed in bursts. The burst aggregation algorithm that is used to formulate the burst shapes the traffic in the OBS network. There are several algorithms for burst aggregation in the current literature. These algorithms consider a combination of the following parameters: a pre-set timer, a maximum burst size and a minimum burst size. When the timer expires, an edge may form a burst. Burst aggregation algorithms may offer QoS by adjusting their characteristics, such as timeout and/or minimum/maximum burst sizes corresponding to the traffic demand [2], [3]. Various resource reservation schemes have been proposed for the transmission of a burst (see Perros [4]). One of these schemes is on-the-fly connection set,up with delayed setup and timed release. In the on-the-fly connection setup a control packet is first sent and then after a predetermined offset the corresponding data burst is sent. An OXC allocates the necessary resources within its switch fabric so that as to switch the incoming burst at the time the burst is due to arrive (delayed setup) for a period of time equal to the burst duration (timed release). The on-the-fly connection setup scheme, which is the prevalent scheme, leads to burst loss. This is because, the setup request may be refused by an OXC due to contention at the required output port. However, this may not be known to the edge node at the moment of transmission of the burst. Burst loss is a negative characteristic in a high speed OBS network that promises to deliver QoS. Several solutions to alleviate the problem of burst loss have been proposed such as fiber delay lines (FDL), wavelength conversion and deflection routing. A small number of FDLs ([5], [6], [7]) could be used in order to reduce burst loss. Fiber delay lines require lengthy pieces of fiber, and therefore they cannot be commercialized. Wavelength conversion is a viable solution to the burst loss problem. In this case, an incoming burst on a wavelength that is currently in use at the destination output fiber, can be converted to another free wavelength. Finally deflection routing ([8], [9]) may offer an alternative path to the destination device and divert a burst that would be lost otherwise. This path may include

A Zero Burst Loss Architecture for star OBS Networks

3

more hops making deflection routing an ineffective method. Also, bandwidth has to be reserved especially for the overflow traffic over the path that the deflected burst will take. Obviously in order for OBS to become commercially viable, new schemes have to be devised which will either guarantee a zero burst loss or a very low burst loss at high utilizations. In [10] we described zero burst loss access protocols for OBS rings that are efficient and they can also provide QoS for different classes of customers, such as HDTV streaming, non-real time high priority variable bit data, and best effort data. In this paper, we describe a zero burst loss scheme for star OBS networks. Obviously, more research along these lines is required. The paper is organized as follows. In Section 2, we review various congestion control schemes that have been proposed for OBS networks. These schemes do not alleviate the problem of burst loss. Our zero burst loss scheme is described in Section 3. Results related to the performance of this scheme are given in Section 4. Finally the conclusions are given in Section 5.

2

Congestion Control Schemes

Congestion control in Optical Burst Switching (OBS) networks is an important research area. It is well known that OBS networks are prone to high burst losses and congestion can push these burst losses to alarming proportions. Although congestion control and congestion avoidance is an over-studied topic when it comes to IP and ATM networks, it poses several new and unresolved questions for OBS networks. Since an OBS network functions largely independent of any electrical or optical buffers at its core, congestion control schemes that are applied to buffered networks like ATM differ considerably in their architecture to that of OBS networks. It is a well recognized fact that acceptable blocking rates in OBS mesh networks can be achieved only when the links are under-utilized. For example, in Figure 1 we give a plot of the blocking probability against utiUzation. This plot was obtained using both analytical and simulation models (see [10] for details) under the following assumptions. The graph is for a single outgoing wavelength in a core OBS node with 20 input and output fibers, 100 wavelengths per single fiber, 20 converters (i.e. 20% conversion rate), and with the ability for partial wavelength conversion with degree of conversion 20. Such an under utilized wavelength does not carry a high appealing factor for service providers who would always want to run their links heavily loaded. In an OBS network, congestion and contention are closely related aspects. The boundaries that distinguish these two ideas are quite ambiguous. It is our conviction that contention and congestion drive each other, but the former is more transient in nature than the latter. Contention leads to burst loses due to lack of wavelengths at a core OXC. But the bursts arriving immediately after the losses might just pass through fine. Congestion occurs over a longer time frame and leads to increased contention problems over a longer time period.

Xenia Mountrouidou, Vishwas Puttasubbappa and Harry Perros

1 - * - Simulation(w=10O,k=24,d=20,c=20%) 1 + Analytical(w=100.k=24.d=20.c=20%)

^

+

S 0,3

s

.'*' % utilization of a single outgoing wavelength

Fig. 1. Blocking vs Utilization

Research in OBS hitherto has mainly focused on contention resolution and there have been few contributions that have focused on congestion control. Several different approaches have been investigated in the literature including TCP -based approaches [11] [12], load balancing [13], alternate routing and deflection routing [14], [15], [8]. Below, we review some congestion avoidance schemes. For a more detailed discussion, please refer to Puttasubbappa [16]. 2.1

Deflection routing

Deflection routing at a core OXC involves the selection of a different output fiber than the intended one, if the burst cannot be switched through the original output fiber. Deflection routing has its advantages and disadvantages. 1. The offset needs to be recalculated since the deflected burst takes a different path. 2. Offset recalculation will require intermediate nodes to be equipped with FDLs to delay the deflected bursts if necessary. 3. Deflected bursts may arrive out of order at the destination. End nodes may thus have to store large amounts of data. 4. Deflected bursts may end up in a loop and never reach their destination 5. There have been studies [17] [18] which indicate that deflection routing is ineffective at high traffic loads. Deflection routing in OBS networks requires that the core nodes are equipped with FDLs. Using FDLs, a burst can be delayed for an extra amount of offset time and then sent over the deflected path. It has to be noted that the process

A Zero Burst Loss Architecture for star OBS Networks

5

of deflection and oflFset recalculation can happen several times along the journey of a burst. A core node on receiving a setup message looks at its routing table to determine the next hop based on the destination information the setup message carries. Since the node has knowledge about the current usage of the wavelengths on each outgoing link, it can determine whether this particular outgoing link is congested. The core OXC may maintain not just the primary next hop routing entry but also secondary and tertiary next hops. Thus, each node based on its local information can choose any of the other next hops in case the primary is congested. It then has to calculate the additional offset value in case the route now chosen is longer (i.e. more hops) than the one the burst was traversing in. (This of course assumes that it knows how many hops the new route consists of). This additional delay is made up using FDLs. In case there is an absence of sufficient FDLs available to delay the burst, the burst will have to be dropped. Some of the issues arising out of this mechanism are: 1. The amount of FDLs may be limited. 2. There are pubhcations [17] [18] that deal with several aspects of this method. Key points arising out of these studies are: (a) Excessive deflection may lead to a congestion collapse (b) Excessive deflection may lead to longer end-to-end delays (c) Deflection routing may lead to re-ordering of bursts since bursts may take different routes, and thus higher layer protocols like TCP might find it difficult to operate optimally. Absence of any optical buffering in the network complicates things in the sense that a burst once released with an offset value cannot be slowed down. Intermediate core nodes have no way of manipulating the offset and thus little can be done to prevent a burst loss in the presence of congestion. An alternative solution to the use of FDLs is to set all offsets to a value that is an upper bound of all offsets and it is such that the burst can be deflected any number of times (assuming no cycles), but still stays behind the setup message. This method may lead to possible under-utilization of the network. Deflection routing itself can be implemented using several strategies found in protection and restoration of networks, such as:one hop deflection, path deflection, and N:l deflection. In one hop deflection, each core node maintains next-hop primary, secondary and tertiary routes for a packet heading towards a particular destination. In the presence of congestion on an outgoing link, an alternative next hop is chosen by the core node. In path deflection, each core node calculates primary, secondary and tertiary paths to each destination. When the outgoing link of the primary (secondary) path gets congested, the core node chooses the outgoing link of the secondary (tertiary) path and this path has to be followed to the destination. Path deflection can either be implemented through source routing or using pre-establish GMPLS paths (LSPs). In bypass N : 1 deflection, a congested link of a group of N links can be bypassed by using an alternate link, similarly to the A^ : 1 technique in protection and restoration of networks.

6

Xenia Mountrouidou, Vishwas Puttasubbappa and Harry Perros

It was shown by simulation that deflection routing is not an effective means to lowering the burst loss which can be greatly reduced with a few converters with restricted converter capabilities, (see Jonandula [19]) 2.2

Feedback based schemes

This is a subject that has been studied quite extensively, e.g. the ABR scheme in ATM networks. Feedback messages relay the bandwidth usage and utilization of links back to the ingress OBS nodes thus enabling them to harness the dynamic state of the network. The feedback messages can either be sent as separate control messages or can be piggybacked to control messages traversing in the opposite direction resulting in minimization of control messages. Feedback messages can be used to assist deflection routing. Specifically if OXCs know the utilization levels of hnks ahead of them, they can deflect bursts away from a congested link. Feedback mechanisms can also be used to determine the rate of burst transmission by the sources based on the congestion levels in the links the bursts are supposed to traverse. A feedback based setup has been studied for congestion-based routing techniques in [14]. Such a feedback based based routing technique has been shown to reduce loss probabilities. 2.3

P a t h recalculation

The congestion control techniques described in the previous sections can be seen as short-term schemes since they operate at smaller time scales. Path recalculation can be seen as a long-term congestion control scheme since it operates at a much larger time scale than the above schemes. The motivation for path recalculation is that the state of the network in terms of congestion might reach a stage when short-term schemes can no longer be effective. In such a scenario, a radical change in routing paths needs to be made at a larger topological area. The path calculation can either be distributed or centralized with a master node. Irrespective of the routing architecture, this mechanism facilitates a new routing pattern and thus a chance for the stagnant network to solve its congestion problems. Different source-destination flows between all pairs of nodes that satisfy quality of service criterion of the optical signal can be calculated.

3

A zero burst loss scheme for star networks

As shown in Figure 1, presented in the previous section, the utilization per wavelength has to be kept extremely low in order for the burst loss to be within an acceptable level. Congestion control schemes, such as deflection with FDLs, do not lower significantly the burst loss (see Jonandula [19]). As mentioned above, in order for OBS to become commercially viable, we will need schemes which either eliminate burst loss all together, or provide a very low burst loss but high utilizations.

A Zero Burst Loss Architecture for star OBS Networks

7

In this section, we discuss a zero burst loss solution for star OBS networks. Current technological developments permit the transmission of an optical signal over a long fiber without intermediate amplification or signal restoration. This trend, obviously, is only going to continue in the future. In view of this, it is not hard to imagine that a single OBS core node can serve edge nodes over a large geographical area, whereby an edge node may be as many as 1,000 kilometers away from the core node. If the density of edge nodes is high, then multiple OBS core nodes can be used, as shown in Figure 2. In this case, each edge node has one OBS interface for each core node it is connected to. In the remaining of this paper, we will assume a single OBS core node, since the additional OBS nodes are independent of each other. In a star configuration, it is possible to provide zero burst loss, if we let the core node do the scheduling. That is, the offsets are determined by the core node. Each edge node sends a control packet to the core node requesting a transmission of a certain duration to a particular destination edge node directly cormected to the core node. Using a simple horizon scheduler, for each outgoing fiber the core node can manage all the burst transmissions without any loss. However, the propagation delays for far away edge nodes may take this toll on the network throughput. Below we describe the bimodal burst switching architecture that provides a solution to the issue of long propagations.

3.1

Bimodal Burst Sw^itching Architecture

This architecture referred to as Bimodal Burst Switching (BBS) uses the delayed setup timed-release scheme compound with two modes of operation. The first mode (Mode 0) applies to an edge node that is close to core node, and the second mode (Mode 1) applies to a distant edge node. BBS can cover a large geographical area (1,000 km radius) and it is implementable in hardware as described in [20]. Also, it assumes that the OBS core node is a bufferless switch equipped with full conversion on each outgoing fiber. Each edge node is linked to the core node via an upstream and a downstream fiber, each carrying W wavelengths. Furthermore, each edge node may use both operation modes to send data, depending on its proximity to the core node. Therefore, in a network that has A'' edge nodes, each edge node may include 2A^ — 2 destination queues, where packets are classified based on the destination and the mode of operation. The core node has a number of parallel switching planes equal to W, tlie number of wavelengths in a WDM link. The number of edge nodes that the core node can support is equal to the number of dual ports per switch plane. This architecture introduces an innovative scheduler that performs the flow regulation of the traffic that arrives at each edge node. The scheduler is embedded in the controller of the core node. The core node does not use buffers on either inputs or outputs. The main structures that are used by the

Xenia Mountrouidou, Vishwas Puttasubbappa and Harry Perros Core Node 1

Core Node 2

Core Node 3

Core Node 4

Fig. 2. Star OBS Network topology

controller in order to make a scheduling decision is the Calendar and the Melement array. The Calendar keeps track of the time when the uplink wavelengths to each edge node are going to be free. It consists of K elements. Preferably K is equal to N * W, where W is the number of wavelengths per fiber and A^ the number of edge nodes. We may also use a two-dimensional array with N rows and W columns to store the Calendar structure. If an element that belongs to the i*'* row and w*'' column of the Calendar is equal to j , then this means that the w*^ wavelength of the edge node i is free at time slot j . The time slot of the Calendar structure is long enough to allow a contiguous period of time to schedule bursts and short enough to have small delays between bursts. It is usually between 1msec and l/j„sec. The M-element array keeps track of the availability of the output edge nodes. It consists of M elements, where M is A'' * W. We use a two-dimensional array with A'^ rows and W columns for the M-element array elements, that are stored in the same way as the Calendar elements. The scheduhng algorithm, implemented by the controller, consists of two modes. Mode 0 and Mode 1. This differentiation is based on the proximity of the edge node to the core node. The proximity is determined by measuring the roundtrip propagation delay between the edge node and the core node. Mode 0 is used for edge nodes that are at a small distance d from the core node (d < 100 km) and consequently have a small round trip propagation delay. On the other hand. Mode 1 is more suitable for distant edge nodes [d > 100 km) that have a large propagation delay. As will be explained below the main difference between these two modes is that in the first mode the flow rate regulation is provided to waiting bursts whereas in the second mode it is provided to anticipated bursts.

A Zero Burst Loss Architecture for star OBS Networks

9

M o d e 0 scheduling. In this case, an edge node sends requests to transmit bursts to its ingress OXC. These requests are sent by the edge node at fixed intervals. The operation of Mode 0 is as follows: - Transmission: Edge node i receives packets which it then buffers to the appropriate destination queues. In an OBS network with A'' edge nodes, there exist N — 1 Mode 0 destination queues at each edge node. Every T /isec, the edge node checks the input queues and forms bursts subject to a minimum and a maximum burst size. For each burst it issues a burst request that is stored at the burst request queue. Each edge node has one request queue where it stores all the burst requests for any destination, until they are sent to the core node. Each request consists of a number of fields such as: source, destination, size and an ID number. - Scheduling: Every T //.sec edge node i sends all the burst requests it has stored until that moment in a single control packet to the core node. This procedure needs time equal to one-way propagation delay to be completed. Once the control packets reach the core node, the controller that implements the scheduler decides when the burst will be transmitted using the shortest horizon scheduling policy. This decision is formed using the Calendar and the M-element array. The scheduler scans the Calendar to find the first uplink wavelength of any edge node that is free, then calculates the horizon for the specific edge node's requests. The horizon for each burst request is computed as the difference of the time slot at which any downlink wavelength of destination is free, to the time slot that the uplink wavelength of the source is free. (Full wavelength conversion is assumed). The burst that is destined to the edge node which has the minimum horizon value is served first. According to the proposed scheduling policy it is preferred to schedule the minimum negative value, because this means that the destination is available earlier than the source, so the source may start transmitting immediately. For example, if source edge node i has a free uplink wavelength at time slot 10 and requests to transmit to destination edge nodes j and k that have free downlink wavelengths at times 5 and 15, the horizons are -5 and 5. It is preferable to schedule the request destined to j since the source can start transmitting to it immediately. After a request is served the Calendar and the M-element array are updated. Then the Calendar is scanned in order to find the next available wavelength and the above scheduling procedure is repeated, until all the requests that the edge nodes sent at this time are scheduled. When all the requests are scheduled, the core node sends permits to the edge nodes containing information as to when they can transmit their bursts. An edge node may receive permits on its downlink wavelengths while at the same time it is sending new requests on its uplink wavelengths. Interleaving burst requests and permits reduces the waiting time of a request. It is clear that this mode depends highly on the round trip time. The delay of a burst request is equal to one round trip time plus the queueing delay.

10

Xenia Mountrouidou, Vishwas Puttasubbappa and Harry Perros

The queueing delays of a particular burst request depend on the number of requests that are scheduled prior to this. - Reception: Each destination edge node receives bursts from the core node which are buffered electronically, disassembled to packets and then delivered to its users through other interfaces. M o d e 1 scheduling. In Mode 1 burst switching, data is still transmitted in bursts, but the initial phase in OBS where an edge node sends a request to its ingress OXC has been eliminated. Mode 1 scheduling is preferable when the propagation delay is large. Unlike Mode 0, a Mode 1 edge node does not issue burst requests. Rather, the edge node requests and is allocated a fixed bandwidth for each destination during the initialization phase. This bandwidth is calculated based on the traffic between the edge node and each destination edge node, and it is made available to the edge node in the form of burst sizes. These burst sizes are fixed in time and they repeat periodically. Let tij fisec be the transmission time allocated to the traffic from i to j , and let this be repeated every T usee. Then the bandwidth allocated to edge node i for transmitting traffic to edge node j is {tij/T)*V Gbits/sec, where V Gbits/sec is the transmission speed. The edge node communicates the values i^, j = 1,...,N, j ^ i and T to the controller. The controller issues automatically a burst request of duration tij every T fj,sec for each destination, where tjj < T for every i,j = 1, 2, ...A'^. These burst requests are then scheduled following the same procedure as in Mode 0 operation. Next the scheduler issues permits which are sent to the edge node. It is clear that the core node defines a different bandwidth allocation for every stream ij. This offers a fiexibihty to satisfy the different traffic requirements of each stream. We note that the bandwidth allocated to each Mode 1 edge node by the controller can be renegotiated using specially designed messages. Such renegotiation will ta.ke pla.ce when the traffic arriving at an edge node changes significantly. Adapting the bandwidth allocation to the traffic demand is considered as a congestion avoidance scheme. Therefore, the BBS architecture prevents burst loss due to congestion. The Mode 1 operation is summarized as follows: - Transmission: The edge node may transmit the data it has gathered up to this moment based on the permit information. In this case there is no minimum or maximum burst size used to define the size of a burst. This means that the burst aggregation algorithm used at the edge nodes does not have an effect in the burst characteristics when using Mode 1. The burst size B is defined by the transmission time iy as: B |io{

Fig. 3. The operation of the bimodal vscheduler

Furthermore, the burst aggregation period T was set to 256 fj,sec. The same period T is used for convenience as a request period for Mode 0 edge nodes and as a permit period for Mode 1. The one way propagation delay between an edge node and the core node for Mode 0 edge nodes was set to 500 ^sec, which means they are at a 100 l^m distance from the core node, and for Mode 1 edge nodes to 5,000 /usec, which means they are at 1,000 km from the core node. In this study we ha,ve assumed out-of-band signaling. The signaling messages can also be implemented iu-band, but this was not considered here. Finally, renegotiation of the bandwidth allocation in Mode 1 scheduling is expected to take place less frequently compared to the time scales of the burst transmission operation, and it was not considered in our simulation study. Each edge node has a 10 MB electronic buffer to store the packets that arrive from external sources. The arrival process is an Interrupted Poisson Process (IPP) as described in [21]. This IPP arrival process is an O N / O F F process, where both the ON and OFF periods are exponentially distributed. Packets arrive back-to-back using Poisson distribution with rate A during the ON period. The transmission speed is 10 Gbps. Packets do not arrive during the OFF period. The packet length is assumed to be exponentially distributed with an average of 500 bytes. The last packet of the ON period may be truncated so that its last bit arrives at the end of the ON period. The squared coefficient of variation c^ of the packet interarrival time was used to characterize the burstiness of the packet arrival process. This coefficient is defined as the variance of the packet interarrival time divided by the squared mean packet inter-arrival time. Assuming that the distribution of the ON period is exponential with average l/fii and the distribution of the OFF period is exponential with average l/;Lt2 we have:

A Zero Burst Loss Architecture for star OBS Networks

1+

13

'"'•'

where A is the arrival rate of a packet during the ON period and j = 0.4yusec. Finally to characterize completely the arrival process the average arrival rate is used, given by: jiOOBytes) (WGbps)

average arrival rate •

{lOGbps)ti2 Ml +M2

Given the c^ and the average arrival rate we calcvdate the quantities fj,i and /^2- In our simulation experiments c^ was set to 5 and 20, and the arrival rate was varied from 6 Gbps to 100 Gbps. Packets arriving at an edge node were assigned to a destination using the uniform distribution. This arrival process captures the burstiness of the Internet traffic, especially when voice and video are transferred. It is also confirmed experimentally that it models accurately the traffic in a network [22], [23]. The simulation outputs consist of the mean overall delay per packet for all nodes and the percentage of utilization of an uplink or a downlink wavelength. In all the figures provided, the results are plotted with 95% confidence intervals estimated by the method of the batch means [24]. The number of batches is set to 30 and each batch consists of at least 10,000 bursts/edge node. The confidence intervals are very narrow and as a result are barely visible in the figures. The Bimodal Burst Switching (BBS) scheme is compared against the case where all A^ edge nodes operate under the Mode 0 scheme, indicated in the graphs as "Mode 0". BBS is also compared against the case where all TV edge nodes operate under the Mode 1 scheme, that is the bandwidth allocation scheme, indicated in the graphs as "Mode 1". We recall that in the BBS scheme edge node 1 to N/2 operate under Mode 0 and edge nodes {N/2 + 1) to N under Mode 1. The calculation of the intervals tij for Mode 1 was based on the average arrival rate. Full wavelength conversion was assumed. An overall picture of the delay per packet when all edge nodes are scheduled using the three scheduling schemes under study for c^=5, is shown in Figure 4 (a). The average arrival rate at every edge node is 6 Gbps. The delay of a packet is the time elapsed from the moment it fully arrives at an edge node to the moment it is delivered to a destination edge node. That is, it consists of the queueing delay at edge node plus the propagation delay from the transmitting edge node to the destination edge node. Edges nodes 1 to 5 are at short distance from the core node (i.e. they have 500 ^sec one-way propagation delay) and edge nodes 6 to 10 are far away (i.e. they have a 5,000 //see one-way propagation delay). Packets arriving at each edge node were assigned to a destination node using the uniform distribution. The increased delays of the traditional OBS scheme can be easily seen in this figure. As the number of wavelengths increases, we observe an almost linear decrease in the packet delay for the BBS and Mode 1 schemes. The difference between Mode 0 and BBS evident: Mode 0 overall average delay per packet is much higher. An interesting observation is that the average delay per

14

Xenia Mountrouidou, Vishwas Puttasubbappa and Harry Perros

\ \

/O'lji?

K^

\

V

^ »—^

"^•^B

__^

r^62S Q

men "^^^^^*^:*-

- * - Ho3 •! 1

'»^.„^_ •-"at,-

—

'*"'" * "*'*-*a5^

ific-ii 7Q

\

-»--••

—BBS '»-a-.=E^--j^

JO -iQ SO to ';a SU 9i/ iljif Sumber of Wav«tengtt)t

Fig. 4. (a) Mean packet delay for all 10 edge nodes vs. number of wavelengths for c^=5, (b) Mean packet delay for all 10 edge nodes vs. number of wavelengths for c^=20

packet for the BBS and the Mode 1 are very close. This lea.ds us to the conclusion that differentiating our scfieduling technique between distant and closcby edge nodes does not oflfer a large improvement on the average delay per packet. Figure 4(b) gives the average delay per packet when the input traffic is burstier, i.e. c^ = 20. This burstiness corresponds to traffic that may have long intervals of silence (OFF period), Hke VoIP or video. It can be observed that there is no significant difference for the BBS and Mode 0 schemes when the burstiness increases. Figure 5 shows the percentage of utilization of an uplink/downlink wavelength. The uplink and downfink wavelength utilization is the same. That is because the same arrival process to each edge device was assumed and destination nodes are uniformly chosen. When we use only one wavelength in our model, wavelength utilization approaches 60%. All three schemes have the same utilization. As mentioned above Mode 1 scheduling scheme is used to schedule bursts that are not yet formed at the edge node. If the wavelength utilization is high, this means that there is always a burst formed for each destination in every edge node that is scheduled using this scheme. Then the bandwidth that is allocated periodically is not wasted. On the other hand, the utilization per wavelength decreases since the number of wavelengths increases and there are more alternative paths for a data burst. This means that lower per wavelength utilization does not affect Mode 1 and BBS schemes if the input traffic and the overall utilization remains the same (60% for all wavelengths in one fiber link). Figure 6 shows how the average delay per packet is affected when the average arrival rate of the input traffic is varied and the rate of packet arrivals is set to 100 Gbps for all three scheduling schemes, with all other parameters remaining the same as above. There is one uphnk and one downlink wavelength for every fiber link. When the average arrival rate is >80 Gbps we get very high delays for Mode 0 and BBS, whereas Mode 1 gives very high delay when it is >90 Gbps. These delays are not drawn in this Figure. The BBS and Mode 1 schemes scale well when the average arrival rate increases. Mode 0 on the other hand has a high increase in the mean delay when the average arrival rate is >60 Gbps. This proves that BBS and Mode 1 are suitable for the high bandwidth demands.

A Zero Burst Loss Architecture for star OBS Networks

-Mode e

1

iO

20

30

40

so

60

70

SO 90

100

Number of WaveNiRgths

F i g . 5. Mean utilization for all 10 edge nodes vs. number of wavelengths 900Q ^^^-'''••^df.' 0 SGOO -

•—

m-—

7000

1 6000 J SODO V Q

—*r-MC;Qel

4000 • 3000 ^000 •

6

10

2ii

30

40

SO

6t)

70

BO

Average ArHvaf Rate (Gbps)

F i g . 6. Mean packet delay for all 10 edge nodes vs. average arrival rate

15

16

Xenia Mountrouidou, Vishwas Puttasubbappa and Harry Perros

9O0y 8000 700G 601)0 50 DO -BBS 4000

-r- "1

10

20

"iO

40

SO

i-

60

70

80

90

100

Number of Edge Nodes

Fig. 7. Mean packet delay for all edge nodes vs. number of edge nodes for c^=5

In Figure 7 the average delay per packet for all edge nodes is plotted when the number of edge nodes for c^ = 5 is varied. It is assumed that W = 1, i.e. one uplink and one downlink wavelength. The BBS scheme scales well as the number of edge nodes increases, whereas Mode 0 has large delays. It is also observed that Mode 1 scales very well, remaining almost constant. The low delays of Mode 1 and BBS is contrasted to the high utilization percentage, that is about 60% when only one wavelength is used. At this point the limitation of Mode 1 compared to BBS is exposed. Based on our simulation experiments both schemes have similar performance, therefore one would think that there is no point in differentiating scheduling in two modes. Mode 1 scheduling would be efficient to schedule all nodes. This is not the case. Mode 1 requires bandwidth allocation and when the edge nodes increase in number we have to increase the bandwidth allocated to each one of them as well. This may not be feasible on a link with finite bandwidth. On the other hand BBS is using Mode 0 in combination with Mode 1. Therefore, it does not need to allocate bandwidth for all edge nodes, but only for those that are scheduled using Mode 1. Furthermore Mode 1 scheduUng scheme may waste useful bandwidth, as it is static most of the time. When the input traffic is low, the bandwidth allocated by Mode 1 scheduling may be too large, and therefore it will be wasted. On the other hand if the traffic is too high, there will be large delays as the packets will have a longer queueing time. Therefore, if the traffic pattern changes oftenly. Mode 1 scheduhng is not efficient. Further work on the evaluation of the BBS scheme, can be found in [25].

5

Conclusions

In order for OBS to be commercially viable, schemes have to be devised that provide very low burst loss at high utiUzations or are burst loss free. In this paper, we presented a burst loss free scheme for star OBS networks. More than one star OBS network can be used in order to provide large geographic coverage. How

A Zero Burst Loss Architecture for star OBS Networks

17

these s e p a r a t e s t a r t networks can be linked t o g e t h e r so t h a t t h e entire resulting network is b u r s t loss free, is a p r o b l e m currently u n d e r investigation.

References 1. Puttasubbappa, V., Perros, H.: Access protocols to support different service classes in an optical burst switching ring. (In: Networking 2004) 2. Choi, J., Choi, J., Kang, M.: Dimensioning burst assembly process in optical burst switching networks. In: lEICE Transactions on Communications. Volume E88-B. (2005) 3855-3863 3. Vokkarane, V., Jue, J., Sitaraman, S.: Burst segmentation: an approach for reducing packet loss in optical burst switched networks. In: IEEE International Conference on Communications. Number 5, IEEE (2002) 2673-2677 4. Perros, H.G.: Connection-oriented networks: SONET/SDH, ATM, MPLS, Optical Networks. Wiley (2005) 5. Yoo, M., Qiao, C , Dixit, S.: Qos performance of optical burst switching in IPoverW D M networks selected areas in communications. IEEE Journal on Areas in Cormnunications 18(10) (October 2000) 2062-2071 6. Ganger, C , Dolzer, K., Scharf, M.: Reservation strategies for FDL buffers in OBS networks. In: Proceedings of the IEEE International Conference on Communications, IEEE (2002) 7. Yoo, M., Qiao, C , Dixit, S.: The effect of limited fiber delay lines on qos performance of optical burst switched WDM networks. In: Proceedings of the IEEE International Conference on Communications. Number 2, IEEE (2000) 974-979 8. Hsu, C.F., Liu, T.L., , Huang, N.F.: On the deflection routing in QoS supported optical burst-switched networks. In: IEEE International Conference on Communications. Number 5, IEEE (2002) 2786-2790 9. Kim, S., Kim, N., , Kang, M.: Contention resolution for optical burst switching networks using alternative routing. In: IEEE International Conference on Communications. Number 5, IEEE (2002) 2678-2681 10. Puttasubbappa, V., Perros, H.; An approximate queueing model for limited-range wavelength conversion in an OBS switch. (In; Networking 2005) 11. Wang, S.: Using T C P congestion control to improve the performances of optical burst switched networks. IEEE ICC'03 (International Conference on Communication) (2004) 12. Wang, S.: Decoupling Control from Data for T C P Congestion Control. PhD thesis. Harvard University (1999) 13. Battiti, R., Salvadori, E.: A load balancing scheme for congestion control in MPLS networks. Technical report, Universita di Trento (2002) 14. Vokkarane,, G.T.V., .Jue, .LP.: Dynamic congestion-based load balanced routing in optical burst-switched networks. IEEE Globecom (2003) 15. Kim,, S.K.N., Kang, M.: Contention resolution for optical burst switching networks using alternative routing. In Proceedings of IEEE ICC (2002) 16. Puttasubbappa, V.: Optical Burst Switching: Problems, Solutions and Performance Evaluation. PhD thesis. North Carolina State University (2006) 17. Morikawa, X.W.H., Aoyama, T.: Deflection routing protocol for burst switching WDM mesh networks. In proceeding of Opticomm (2000) 257-266 18. Wong, A.Z.H.V.Z.R.E., Zukerman, M.: Reduced load Erlang fixed point analysis of optical burst switched networks with deflection routing and wavelength reservation. The First International Workshop on Optical Burst Switching (WOBS) (2003)

18

Xenia Mountrouidou, Vishwas Puttasubbappa and Harry Perros

19. Jonandula, V.: Performance analysis of congestion control schemes in OBS mesh networks. MS thesis (2004) 20. Beshai, M.: Burst switching in a high capacity network. US Patent (2001) 21. Fischer, W., Meier-Hellstern, K.: The Markov-Modulated Poisson Process (MMPP) cookbook. Performance Evaluation 18 (1992) 149-171 22. Karagiannis, T., MoUe, M., Faloutsos, M., A.Broido: A nonstationary poisson view of the internet. IEEE INFOCOM (2004) 23. Heffes, H., Lucantoni, D.M.: A Markov modulated characterization of packetized voice and data traffic and related statistical multiplexer performance. Journal on Selected Areas in Communications SAC-4(6) (1986) 856-868 24. Perros, H.G.: Computer simulation techniques: the definitive introduction. Available at: http://www.csc.ncsu.edu/faculty/perros/books.html (2003) 25. Mountrouidou, X., Perros, H., Beshai, M.: Performance evaluation of optical burst switching schemes for grid networks. In: GridNets 2005, IEEE (2005)

Safeguarding the Transmission of Biometric Measurements Used for Authenticating Individuals Ernst L. Leiss Ernst L. Leiss, Dept. of Computer Science, University of Houston, [email protected]

Abstract: Various biometric measurements can be used to establish the identity of individuals. Common to many of them is the fact that a significant amount of information is collected and transmitted; this information is then used to compare the captured biometric data with the previously recorded information identifying a particular individual. If the two pieces of information are similar, it is assumed that the identification is carried out correctly.

An important problem in this process is the safeguarding of the transmission of the captured information. In many cases, it cannot be assumed that the channel over which this information is transmitted is secure. Therefore it is crucial that the process be viable even if the channel is insecure. We outline an approach that ensures the security and integrity of this process. We demonstrate that this approach is highly effective in that it requires only minimal additional storage capacity and virtually no additional processing capacity to be functional. Support of this research under NSF grants DUE 0313880, SCI 0453498, and OISE 0519316 is acknowledged.

1. Introduction The authentication of users in shared systems is an important problem; it has numerous solutions [2, 3, 5, 10]. Historically, computer systems have used passwords to establish the bona fides of a would-be user. Passwords have a number of advantages and disadvantages. Among the advantages are the following:

Please use the following format when citing this chapter: Leiss, E.L., 2006, in IFIP International Federation for Information Processing, Volume 213, Network Control and Engineering for QoS, Security, and Mobility, V, ed. Gaiti, D., (Boston: Springer), pp. 19-26.

20

Ernst L. Leiss

Compactness: Extremely little information must be stored to carry out the identification process. Universality: It is easy for anyone to invent a password. There is an unlimited number of passwords. Passwords can be retired and replaced at will. The use of passwords is extremely efficient: Both providing new passwords and using passwords to verify identity is very fast. Among the disadvantages are the following: The connection between user and password is tenuous at best: There is no inherent connection between user and password, other than that the user invented the password. Passwords are typically not unique: Many users tend to invent the same passwords. While the compactness of passwords was an attractive feature for earlier computer systems, with their limited space, the disadvantages of passwords have provided the impetus for the study of alternative means for authenticating users. The most important of these are biometric measurements [8, 11]. Biometric measurements extract information that is tied directly to the physical properties or aspects of a user. They may be either entirely descriptive or capture abilities as well. Among the descriptive ones are fingerprints, retina scans, iris scans, hand geometry, face authenfication, and DNA. Among those that capture abilities are signature-based verification, voice authentication, and methods based on keystroke dynamics. Common to all are the following features: The biometric measurements are intimately tied to a specific individual. They are more or less unique: Within reason, they uniquely identify a specific individual (see more specific discussion below). The amount of data captured is significantly larger than that for passwords. Also, the amount of storage to accommodate the data against the captured data are compared is much larger. Biometric measurement data must be similar to the stored data to generate a much. This is in marked contrast to the situation for passwords, where an exact match is required. In other words, biometric data require a similarity condition to be satisfied, while password schemes require a test for equality. It is important to understand the implications of the similarity test, especially when contrasted with the equality test. While passwords are very definite, biometric measurements are inherently approximate; in most cases, there is a good deal of variability (of the objective aspects that are measured [most biometrics] or of the actual measurements [DNA]). Therefore, it is entirely inappropriate to apply a test for equality, which is of course precisely called for with passwords. Indeed, if one were to apply a test for equality in the context of biometric measurements to determine whether a match is present, virtually all tests would result in rejecting the authentication attempt. Fingerprints [6] have been used for about a century to identify persons, primarily perpetrators of crimes. Fingerprints are generally assumed to be entirely unique.

Safeguarding the Transmission of Biometric Measurements Used for Authenticating Individuals

21

However, not all individuals have suitable fingerprints, either because of missing fingers, medical conditions, or work-related abrasion. Typically, a great deal of fingerprint information is captured, but only certain aspects (called indicia) of the captured data are extracted and used in the similarity test. The amount of information used to establish valid matches (the number and type of indicia) varies. Retina scans [7, 8] are based on the pattern of blood vessels in an individual's eye retina. The information contained in the measurements is generally considered to identify uniquely a given individual. The method is fairly intrusive and therefore not commonly employed. Iris scans [8] are similar to retina scans and use the iris of the eye instead of the retina's blood vessel pattern; however, they are significantly less intrusive. They are considered to identify uniquely a given individual; even identical twins are said to have different iris scans. A substantial amount of data is captured which is then used to compute a similarity relation as basis for determining whether a match is present. Hand geometry [4] uses geometric aspects of the hand and specific physical characteristics of hand and fingers. The data captured are either several 2D images or a 3D image. Again, a good deal of information is captured (approximately one hundred different measurements). However, it is not entirely clear how unique the resulting measurements are; typically, hand geometry is used to identify individuals drawn from a relatively small set (e. g., access control to a specific facility). Face authentication [9] is easily the oldest technology for identifying individuals of course not by computer, but by humans in their daily interactions. In the context of computer-based authentication, it is in fact one of the newest technologies. It measures geometric facial structure (distance between eyes, nose, mouth, jaw, etc.), either in 2D (not very reliable) or 3D. Measurements use either visible or infrared light (the latter being known as thermal imaging). The method is supremely nonintrusive; it is in fact the only biometric authentication approach that can be administered without knowledge and cooperation of the subject and also at a distance. A large amount of data is captured in this process. The similarity test is correspondingly complex. DNA [1] is of course the ultimate identifier (except that it cannot differentiate between identical twins). While it has major drawbacks within the context of computer-based authentication, it shares with the other biometric approaches the aspect that a great deal of data must be captured in order to obtain enough of a basis to carry out a similarity test. Signature verification [8] extends the classical signature approach (which only considers the final result, the signature) and includes information captured in the process of supplying the signature, such as pressure exerted on the surface during portions of the signature, variation of the angle of pen to surface for portions of the signature, speed of producing segments of the signature, and so on. Again, a good deal of information is captured which provides the basis for the similarity test against the stored template of information associated with a specific individual.

22

Ernst L. Leiss

Voice authentication [7] employs specific characteristics of an individual's speech to identify that person. Because of the variability of a person's speech depending on factors such as medical conditions (cold, asthma, etc.) and fatigue, the similarity condition is especially crucial. Again, both the stored template (voice sample) and the captured voice record imply significant data requirements. Finally, the (mechanical) way a user types text at a keyboard can be used to authenticate that user. While the discriminative power of keystroke dynamics [7] is limited (it is unlikely that millions of typists can be reliably differentiated from each other by this approach) and the failure rate is larger than with other biometric methods, it shares with them the fact that a substantial amount of data must be captured and transmitted in order to apply this approach. A major disadvantage of all biometric approaches over password schemes is that it is (virtually) impossible to change biometric aspects of a person. In particular, this imposes dramatically more stringent security and integrity requirements on the operation of such methods, since it is not possible to "assign" to a human a new biometric measurement in case the original one was compromised. This is in marked contrast to passwords where the consequence of discovering the thef^ of a password is the issuance of a new one. This is possible because there is no tight link between the password and the individual. In the case of biometric information, this link is very tight and for all practical purposes indissolvable.

2. The Problem of Intercepts We will assume in the following that sufficient security and integrity conditions are satisfied at the two endpoints of the process. In other words, we assume that the capturing device is reasonably secure and that the system involving the storage of the template and the processing of the similarity condition satisfies the requisite security and integrity constraints. This assumption is generally realistic because the two endpoints tend to be under the control of the agent interested in the proper functioning of the authentication process. Our specific concern for the purpose of this paper is with the transmission of the captured data. The problem of intercepts can be stated as follows: Assume that biometric measurements of an individual requesting access are captured at an access point; these data are then transmitted to a central facility where it is determined whether a match between the captured measurements and the stored template exists. This involves carrying out the similarity test. If a match does exist, the individual is granted access; otherwise additional attempts may be permitted before access is definitively denied. The problem we address here is the following: How can we avoid that a third party intercepts the captured measurements for the purpose of reusing them at some other time and in an illicit way? While the inclusion of timing information may impede this replay attack, this is fraught with difficulties; in

Safeguarding the Transmission of Biometric Measurements Used for Authenticating Individuals

23

particular, this assumes that the measurement capturing access point is impervious to any attacks, in particular to schemes that cause it to change its local time. Since synchronization in this approach is crucial, the ability of the central processing facility to synchronize the times of the local measurement stations may be compromised and result in resetting the time, which in turn would defeat the approach using timing information to safeguard against replay attacks. This synchronization is needed more within the context of biometric measurements than for passwords because of the significantly larger amount of data transmitted. This is true even if the data to be transmitted are first encrypted (in this case the timing information would be part of the encrypted data).

3. The Proposed Solution The problem of intercepts can be avoided by using the scheme described below. Here we assume that no reliable timing information is available. We require that the biometric measurements be encrypted before transmitting them, using some reasonably strong encryption method. An important implication of this assumption is the following [5,10]: Changing a single bit in the ciphertext (here the transmitted, encrypted measurement data) implies that the decryption of this modified ciphertext results in a plaintext that differs from the original plaintext in about half of all bits. In other words, a small change in the ciphertext will result in a huge change in the resulting plaintext. We now exploit the fact that biometric measurements, in contrast to passwords, contain a great deal of redundancy: changing portions of a password most likely will resuh in another, valid password, while changing portions of biometric measurements will result in data that do not correspond to any real person. To put it differently, if we require passwords to consist of between 6 and 12 characters, using letters and digits, then there are more than four quintillion different passwords, even though there are fewer than ten billion persons; thus, each person would have almost half a billion passwords. On the other hand, biometric measurements may have a size of several hundreds to many thousands of bytes (that is, orders of magnitude more than passwords). Therefore, enormous redundancies are present in them. It follows that because of the redundancy involved, because of the way measurements are taken, and because of the variability of human physical characteristics, no two different measurements are identical. This implies in particular that encountering identical measurements are an incontrovertible proof of a replay attack! The leaves us with two issues to resolve: How to detect identical measurements, and how to ensure that attackers cannot produce artificially small variations in the measurements. The second question is easily addressed: Since the measurements are encrypted before transmission, the attacker has no access to the plaintext, but only to

24

Ernst L. Leiss

the ciphertext. Since a change in the ciphertext dramatically affects the resulting plaintext, such changes will result in (decrypted) measurements that are totally unrelated to the stored template. Therefore the match is guaranteed to fail. Finally we come to the detection of identical measurements. Here, we assume that at the central storage facility, every successful measurement (i. e., every measurement that resulted in a successful match) is stored; then every subsequent access request consists of two parts, the test whether the measurement that was transmitted is identical to any previously transmitted measurement, and the similarity test as before. While the similarity test is most likely carried out on the basis of plaintext data (that is the transmitted encrypted data must be first decrypted), the test for equality can be applied either to cipherdata or decrypted data. (Recall that all modern password schemes operate exclusively on cipherdata!) It is important to understand that the similarity tests involved in biometric data are quite complicated; in fact, some of the schemes mentioned above do not operate in real time, for this reason. An inherent problem is the fact that there is neither an order relation nor a proximity relation between the biometric measurements. (For example, there is no natural order of fingerprints in which "similar" fingerprints would be close to each other while dissimilar ones would be far apart.) However, the test for equality is extremely efficient: it is essentially binary search which runs in time proportional to the logarithm of the number of items to be compared against! One problem with the above scheme is the amount of data that would have to be stored. Assuming that each measurement is IkB, we would have to provide IkB for each successful match. This may be considered excessive. However, it can be drastically reduced: Instead of storing the entire measurement data, we can apply a hash, such as MD5 or SHA [3,10], and reduce the amount of data to a significantly smaller amount. Given the random distribution of the hashes, it is reasonable to limit the size to fifteen bytes; this yields a space of potential hashes of size 2^°, or well over 100 sextillions (10^°), which is more than sufficient to differenfiate between the fewer than ten billion humans alive. Yet, even if there are a million successful accesses in a year, the system requires additional storage capacity of no more than 150MB during a ten-year operation, a rather small amount in view of today's capacities of storage media. It should be clear that the length of the hashes can be considered a parameter - if more space is available (or fewer access requests are anticipated), longer hashes can be used. Note that using a hash that is too short will (on average) result in more accesses being rejected as supposed replay attacks (a false negative, from the user's perspective). To illustrate this, assume the hash length were only one byte; thus, there are only 16 different hashes. Consequently, the likelihood that an access request is rejected as a supposed replay attack is 1 in 16. Note that in practice and given the characteristics of typical biometric measurement systems, once an access request is rejected as a replay attack, the individual requesting access is most likely asked to repeat the access request, generating a new set of biometric measurement data. Given the general nature of the processes, it is virtually inconceivable that this new set is identical to the previous one; in other words, the new data set is different if this is a legitimate measurement, and not a replay attack. Therefore, the likelihood

Safeguarding the Transmission of Biometric Measurements Used for Autlienticating Individuals

25

of the second request being rejected again is greatly reduced, if it is legitimate! How many such repeat attempts are permitted is a policy issue. Important for us is that observation that repeated legitimate measurements necessarily result in different data sets being transmitted and compared against the stored template. This clearly enhances the usability of the approach without sacrificing any aspect of security of the overall system.

4. Conclusion We have outlined an approach that safeguards against a replay attack within the context of using biometric data for authentication purposes. This scheme works in the absence of reliable timing information. It exploits intrinsic aspects of biometric measurements, namely their redundancy and their variability. The resulting method is highly efficient (it requires virtually no additional time to process the information, compared with the generic approach that does not safeguard against replay attacks); it also functions well with a relatively small amount of additional space.

Bibliography [1] C. T. Clelland, V. Risca, and C. Bancroft. Hiding Messages in DNA Microdots. Nature 399:533-534, 1999. [2] A. Conklin, G. Dietrich, and D. Walz: Password-Based Authentication: A System Perspective, Proc. 37* Hawaii Int'l Conf System Sciences, 2004. [3] S. Garfinkel: Web Security, Privacy, and Commerce, Second Edition, O'Reilly and Associates, Sebastopol, CA, 2002. [4] Ingersoll-Rand Corp., IR Recognition Systems, last web site access 10 Aug. 2005, http://www.recogsys.com/company/index.htm. [5] E. L. Leiss: Principles of Data Security, Plenum, New York, NY, 1982. [6] D. Maltoni, D. Maio, A. K. Jain, and S. Prabhakar: Handbook of Fingerprint Recognition, Springer, New York, NY, 2003.

26

Ernst L. Leiss

[7] Microsoft informit.com, Access Control Systems, last web site access 10 Aug. 2005, http://www.informit.com/guicies/content.asp?g=security&seqNum=149&rl=l. [8] Z. Riha and V. Matyas: Biometric Authentication Systems, Tech. Report FIMURS-2000-08, Faculty of Informatics, Masaryk Univ., Hungary, Nov. 2000. [9] T. D. Russ, M. W. Koch, and C. Q. Little: 3D Facial Recognition: A Quantitative Analysis, SS* Ann. IEEE Int'l Camahan Conf Security Technology, Albuquerque, NM, 2004. [10] B. Schneier: Applied Cryptography, Second Edition, John Wiley and Sons, New York, NY, 1996. [11] J. Woodward: Biometrics and Strong Authentication, Osbome/McGraw-Hill, Emeryville, CA, 2003.

The risks analysis like a practice of secure software development. A revision of models and methodologies Jose Carrillo Verdun', Gloria Gasca Hurtado', Edmundo Tovar Caro' and Vianca Vega Zepeda^ 1 Universidad Polit6cnica de Madrid, Departamento de Lenguajes y Sistemas InformSticos e Ingenieria de Software, Madrid, Espana, {jcarrillo,etovar}@fi.upm.es; [email protected] WWW home page: http://www.upm.fi.es 2 Universidad Catolica del Norte, Departamento de Ingenieria de Sistemas y Computacidn, Antofagasta, Chile, [email protected] WWW home page: http://www.ucn.cl

Abstract. The following document, presents and analyzes the Risks Analysis in the whole software development life cycle, framed like one of the recommended practices for secure software development. It present and compare a set of Risk Analysis methodologies and strategies, considering like criteria some classifications propose by different authors and the objectives that they persecute to orient them towards of evaluation criterion for the secure software development.

1

Introduction

When a new software product is developed, assuring the incorporation of all functionalities required by the users to the new system is not enough, a set of quality characteristics exists which must consider it at software designing and implementing time. On these quality characteristics, exist diverse models and standards developed, under which different quality attributes are considered, they can vary of model in model. Between these attributes, they are possible to be mentioned for example, software mantenibility, reusability, correction, integrity, efficiency and security, among others and vary according to the model. In relation to the security, the increasing technology incorporation in all organizational processes, has caused that this attribute acquires real relevance, that at present, multiple researches are made, like one carried out in the United States in 2003 [1], where representatives of the industry, academy and the Government, met them for analyze the consequences of the vulnerabilities of the developed software products under the traditional development models, that models do not incorporate

Please use the following format when citing this chapter: Verdun, J.C, Hurtado, G.G., Caro, E.T., Zepeda, V.V., 2006, in IFIP International Federation for Information Processing, Volume 213, Network Control and Engineering for QoS, Security, and Mobility, V, ed. Gaiti, D., (Boston: Springer), pp. 27—39.

28

Jose Carrillo Verdun 1, Gloria Gasca Hurtadol, Edmundo Tovar Carol and Vianca Vega Zepeda2

adecuately the security like a necessary characteristic throughout the software development life cycle. This forum, in addition, has made a series of recommendations to follow with the purpose of improving the development processes in the software developer organizations. At the present time, several works and proposals about software development, indicate the importance of studying and investigating the products security. For example, the process proposed by Software Engineering Institute of the University of Carnegie Mellon, Team Software Process, which has evolved to the TSP-Secure, or the CMM model, developed by the same Institution, that it has served as base for the development of CMM System Security Engineering. In general, the software security is limited by the work that develops the operators of the implemented systems to protect the vulnerabilities identified in the organization, having a great infrastructure mounted and handled by people who determine and raise the security policies; but software that they protect, has been designed with the security that deserves?. From the beginning of their construction, has been considered the different properties from security and they have been developed throughout its implementation? This article deals with the Security focused on development process, being centered in a revision of the practice of the Risks Analysis from different aspects. In the first place techniques and approaches are described taking like main reference the McGraw proposal for secure software development (section 2). The McGraw's proposal shown in fig 1, introduces best practices of security and involves a interdisciplinary atmosphere to apply them and to develop them, with the purpose of fighting against the problems which it is exposed software, specifically about connectivity, extensibilidad and complexity [2]. Later (section 3), appear different risks management methodologies. And finally, a comparative of risks analysis tools is made, which raises certain practices like security tests application, threats models use, attacks patterns and risks analysis (section 4). Extenml review Sevuriiy

Venftrattoft tasting

requiremnnCs

Ahiiie

jjpv

RLsk anatysis \

Static Analysis (toolsj

I Requirements

j

H'sk atialyxis

V Design

i

Test plans

Field feedback

and use cases

Fig. 1. Software development life cycle - McGraw's proposal

2 Risk Analysis Throughout this document the concepts software security have been treated from the quality perspective, locating the security like an attribute of the same one.

The risks analysis like a practice of secure software development. A revision of models and methodologies

29

Between the diverse concepts that exist of quality, it has been taken like reference that is mentioned in [3]. That one reference to that the quality is given by the client requirements, it is to say that "the quality exists in a product when it is apt for the use that the clients that buy it give him." Considering this definition of quality, it is important to focus the Risks Analysis like a support element to identify those problems that affect a software development project. In the software development processes models Spiral, considered like a realistic approach for great scale systems, the Risks Analysis is also proposed throughout the software development life cycle [4]. This Paradigm uses an evolutionary approach, allowing to the developer and the client to understand and to react to the risks in each level. It uses the creation of prototypes like a risk reduction gear'. The Spiral Model recommends the iterative Risks Analysis within the phases of the software development life cycle, defining explicitly the stages in which it must be made, which agree with the McGraw's model [2]; where it recommends the accomplishment of the Risks Analysis of high level in the early phases and its iterative application throughout the service software development life cycle, specially in the Testing stage [5]. McGraw in [6], raises the security is due to incorporate throughout the software development cycle whole, with the purpose of include characteristic emergent like; to specify what must be protected, who must to be in charge and by how long must become that protection. The security is always related to the information and the services that must be protected, therefore it has relation with the intruders skill, who attack the system. The risk analysis, specially in the design level, allows to identify the main security problems and their impact [7], once identified and classified allows to establish the guide of software security tests. The attack models are a very useful tool for the identification of the risks that can affect a new software product. The classification and identification of the attacks models that Whittaker proposes [8] and the risks taxonomy propose by Wang and Wang in [9] gives facilities to do the risks identification task by means of possible attacks to the system. Some studies made^ sustain the importance that it has to specially do an risks analysis in early stages of the software development. In addition, Microsoft informs that more than 50% of the software security problems they are in design defects, nevertheless, the work for measure the software security and the risks are important throughout the software development life cycle [6]. As it is observed in fig 1, and like it has considered in the preceding paragraphs, it recommended to do the Risk Analysis in the Requirements, Design and Tests stages. In the following secfions, some approaches for each one of these stages are described.

' http://www.itlp.edu.mx/publica/tutoriales/analisis/index.html ^ www.cio.com/archive/021502/security.html

30

Josd Carrillo Verdun 1, Gloria Gasca Hurtado 1, Edmundo Tovar Caro 1 and Vianca Vega Zepeda2

2.1 Risk Analisis in Requirement level Next three strategies considered in [5] are enunciated , they describe the risks analysis process in the Requirements phase: 1. SecureUML: It is a methodology for access control policies modeled and for the handling of the integration model in the software development. SecureUML is located in the access control and the security requirements models for applications in predictable atmospheres. 2. UMLsec: It is an extension of UML that allows the security characteristics modeled related to confidentiality and access control^. 3. Abuse Cases Model: Proposed by Sindre and Opdahl as a way to understand the form in which it would be possible to be responded to the applications threats in less controlable surroundings; they describe the functions that the system does not have to admit. 2.2 Risk Analysis in Design level In the Design level, the risk analysis must fulfill characteristics like the indicated in [6]: a consequent system vision, the high level of system knowledge and the consideration of the typical vision of analysts and developer when they belive in the sufficiency to describe and to discover the design problems in the code level. In adition, it is also necessary to consider the business risk analysis and the architectonic risk analysis: 1. Business Risk Analysis: The companies wants answers as opposed to the investment and to the cost. Therefore, to appraise the impact is a primary target at the moment for do the risk analysis, considering that a good strategy considers questions of cost of the project, so that the direction of the organization can decide the investment in software in relation to the direct cost (responsibility, wasted productivity and reelaboration) as indirect cost (reputation and damage of mark) [10]. 2. Architectonic Risk Analysis: Similar to the previous one, this analysis measures the technical security exposition in the proposed design of an application and it connects them with the impact of the company. Beginning with a representation of high level of the design, the analysis team considers each one of the modules, interface, interaction, etc. against the well-known attack methodologies and their success probability. In order to provide a general visualization of the security state of a software system, the analysts apply the analysis against the individual design subcomponents [10].

2.3. Risk Analysis in the Testing level. The risks evaluation in the Testing phase, it allows to evaluate the system against the different risks that affect the product quality. The Risk Analysis in this stage

^ www4.in.tum.de/~umlsec/

The risks analysis like a practice of secure software development. A revision of models and methodologies

31

allows the project team to arrange and to compare the quality risks with the other categories risks. Categories as like they are defined in [3]: a) Financial risks: It affects the project budget. b) Schedule Risks: They affect the time assigned to project c) Feature Risks: They affect the product characteristics, generally their development obtained a mistaken result. d) Quality Risks: They affect the relation client - satisfaction. This analysis assures the evaluation of product quality risks and the failures identification in different attributes from quality, not only in the software functionality. The Risk Analysis also will have to be do having in account other characteristics, like the Rex Black's recommendation in [3]. The same author proposes the accomplishment of Risk Analysis under three techniques: 1. Informal technique: It works well without considering the development process maturity. The author proposes the use of a table with three columns where the Risks, the error mode associated to the risk will be enunciated and finally a column of Priority, determining evaluation ranks. For the risks idenficacion, the errors and specially the priority; the author raises a meeting with a team of project key people. 2. Standard ISO 9126 Approach: This standard proposes that the software system quality can be measured throughout six very important characteristics: Functionality: System Capacity requeridad Reliability: The system works when it is needed and how it is needed. Usability: The System can be to use like instinctive, comprehensible and useful for the users. Efficiency: Resources use. Mantenibility: System update facility. Performance: System answer capacity. Like in the Informal Technique, the Risk Analysis process, is developed defining quality sub-characteristics also identified in the standard - within which is the security - and the priority levels related to the test of each area are determined for the project stakeholders. 3. Failure Mode and Effect Analysis (FMEA): It is a tool that reviews the potential product or the process failures, it values the risk priorities'*. This tool appears in spreadsheet format and it admits a easy analysis evaluation. The use of this method is advisable specially on development projects very structured, with the purpose of formalizing the of quality risk analysis process. An example of application of this tool is described in [3]. The key of an Risk analysis that supports the software development process in iterative form, from early stages like design, to final stages like Testing; it is the accomplishment of a good analysis, using tools and methodologies able to bring to light software problems that with the tests or a delayed Risk analysis would not be identified or would be correct easily and consequently it obtain a unsecure software development.

http://web2.concordia.ca/Quality/tools/llfailuremodeanalisys.pdf

32

Jose Carrillo Verdun 1, Gloria Gasca Hurtadol, Edmundo Tovar Carol and Vianca Vega Zepeda2

3 Risks Management Methodologies In order to be able to develop a secure software product, able to proactively resitir the attacks which is exposed, it is essential to consider the risks throughout the development cycle. With this objective, different strategies and frameworks have been proposed, they harnesses the risks identification, allowing managing them, that is to say, to plan, to implement and to control the measures against the risks and vulnerabilities founded. 3.1. Risks Management Proposals Next, some strategies propose appear to develop the risks management. They have been selected by the endorsement and recognition that have the organizations who have developed them. Risk Management Framework (RMF): This proposal has been elaborated by Cigital, where the business goals determine the risks, the risks lead the methods, the methods measure the yield, the measures handle the decisions support and the decisions support handles the reajuste/reelaboration and the aplicationn quality [6]. The RMF intention is to assume a capable, consequent and repetible approach for the risks prevention. The Cigital's proposal describes in [11] like a iterative process, it trim in five basic activity stages, concentrated in following the trajectory, visualizing and to understand the process with respect to the software risk. This structure has been applied in the software field during almost 10 years [11] and the design that presents allows to discover the company risks, including those of software. RMF consists of five fundamental stages: 1. Understand the Business Context: The business objectives and risks are identified. The analyst will have to extract and to describe the objectives of the company, the priorities and circumstances to understand the software risks perfectly [II]. 2. Identify and link the Business and Technical Risks: It must identify business risks. Aid to define and to direct the use of technical methods to extract, to measure and to mitigate the software risk. On the other hand, the technical risks, involve impacts like unexpected system faults, failures in the software controls, data modification. This stage is understood like one of the best practices of Fig 1. 3. Synthesize and Rank the Risks: Within the two previous stages, it will find many evident risks, nevertheless the sintetizacion and priorizacion of these will have to serve to give value to the analysis process that is tried to make. 4. Define the Risks Mitigation Strategy: This strategy will be defined under the business context. It must identify the validation techniques that are going to be used to mitigate appropriately the risks. 5. Carry out Fixes and Validate: When a strategy is defined (step 4) it must be executed. When identifying a problem it must be rectified, following the defined strategy. This process must be measured in relation to the risk mitigacidn strategy.

The risks analysis like a practice of secure software development. A revision of models and methodologies

33

Finally the Cigital's proposal raises an additional activity but not less important, to inform and to report. Framework for Managing Information Security Risk: Software Engineering Institute (SEI) of the University of Carnegie Melon, has developed the evaluation strategy OCTAVE (Operationally Critical Threat, Asset and Vulnerability Evaluation), whose objective is to measure the organizacional risk and it focuses in strategic and practical aspects. Aid to an organization to take decisions on the basis of the risks from confidentiality, integrity and availability of the critical assets associated to the information that has its [12]. In this context, the SEI also proposes a Risks Managing Framework [13] it is a risks identification process and its address. Next, they briefly describe each one of the stages that conforms the cyclical process: 1. Identify: The objective of this stage is to anticipate the risks, before problems appear. As result it obtains a set of documented risks, including critical assets, threats and vulnerabilities. 2. Analyze: This point is the of specific risk analysis. The obtained result is the impact and probability of occurrence of each identified risk and a mitigacion approach of such risks. 3. Plan: The actions are determined to develop to improve the organization security and the critical assets protection. As result is obtained: protection strategy; risks mitigation plan; action plans, budget, success criteria, indicators for to monitor the fulfillment of the action plans and the allocations of responsibility for the implementation of these plans. 4. Implement: Its objective is to execute the defined action plans. 5. Monitor: It is the track process of the action plans to determine its fulfillment. Some results of this stage are: Completed actions, progress reports, indicators risk. 6. Control: In this stage it determines if the personnel adjusts to the defined action plans, and if the organizacionales changes have caused new risks. As result new decisions can be obtained on changes in the plans or due to the new risks identification. Magerit: Information Systems Risks Analysis and Management Methodology. The reason of being of Magerit is directly related to the generalization of the use of the electronic, computer science and telematics means, it supposes evident benefits; but also it gives rise to certain risks that must be diminished with security measures which they generate confidence. Magerit allows to know the risk that the work elements are put under, being considered an essential procedure^ This methodology proposes a methodical approach that allows to make decisions with foundation and to rationally explain the taken decisions. The risk determination is made by means of six steps defined methodically in [14], they are: 1. To determine the eminent assets for the organization. 2. To value such assets based on the cost that would suppose for the organization to recover it of a failure of availability, integrity, confidentiality or authenticity. 3. To determine to what threats are exposed those assets. 4. To value the vulnerability of the assets to the potential threats. 5

http://www.csi.map.es/csi/pg5m20.htm

34

Jose Carrillo Verdunl, Gloria Gasca Hurtadol, Edmundo Tovar Carol and Vianca Vega Zepeda2

5. To consider the impact, defined as the damage on the assets derived from the materialization of the threat. 6. To consider the risk, defined as the impact weighed with the rate of occurrence of the threat. Integrated approach for risks mitigation: The Institute of Technology of Californian Jet Laboratory Propulsion along with the University of Californian At Davis, has developed an integrated approach for security risks mitigation [15], it form of the following components; a) Vulnerability Matrix (Vmatrix): It is a data base that contains catalogued vulnerabilities taxonomy and that can be acceded like library. b) Security Assessment Tools (SAT): It is a tools list available, where the intention of each one is included. c) Properties-based Testing: It tries to cover the existing emptiness between the formal verification and the ad-hoc verification. d) Model-Based Security Specification and Verification: It is used to verify if they are fulfilled the wished security properties. The authors indicate that although, each component can be applied in independent form, when applying them altogether, it obtain benefits like the developing system trustworthiness is increase. 3.2. Proposals Analysis The strategies presented in the previous section, they are coincident in several points. Perhaps one of most important is the implicit recognition that it is impossible that the 100% of the detected risks they are eliminated, thus is necessary and imprecindible the risks priorizacion based on the damage that can cause, of such way to invest greater resources in those than can cause greater losses to the organization. Others of the agreement points are given by the iterative approach of the proposals, reaffirming of this form the fact that the risks and threats can be varying through the time, thus, it due to do constants revisions and adjustments to the new organizations reality. The three first proposals are oriented to give processes to follow to manage the risks, however, the last integrated approach proposal, is but well a tools set that facilitates this work.

4 Risk Analysis Tools Next, it briefly describe a tools set for the risk analysis development, which in the following section will be put under a classification and comparison on the basis of the criteria explained down. The tools selection has been do having in account the prestige and experience of the organizations who have developed them or who suggest them as successful tools for the risk analysis.

The risks analysis like a practice of secure software development. A revision of models and methodologies

35

Microsoft's STRIDE: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege^, it is a commercial tool, developed to support the threats identification in the software development. Keith Brown, in their book "The .NET Developer's Guide to Windows Security"^, enunciates the importance of the threats modeled when software is development and designs and he raises as guideline for his modeled the use of this tool. As well, Kenneth van Wyk* raises the accomplishment of risks analysis to prevent threats in the software development and he relates the utility of this tool like support to the work, effort and time that a good risks analysis requires. Sun's ACSM/SAR: It was created to evaluate of formal way the software development and to determine its security level. Mark G. Graff and Kenneth R. van Wyk' study the code maintenance within software development because they consider it vital for the security and they propose methodologies and practices for the security software development from the point of view of evaluations for this analysis. For that reason its proposal enunciates tool ACSM/SAR and ASSET like good elements for the developer. ASSET: Automated Security Self-Evaluation Tool is the automated version of questionnaire "Security Self-Assessment Guide for Information Technology Systems", created by National Institute of Standards and Technology (NIST). This questionnaire looks for to help in the systems security evaluation that has an organization. ASSET is forms of two tools: ASSET-System, this one is the interface that allows to respond the questionnaire; and ASSET-Manager which orders and summarizes the questionnaire application results. Siemerns CRAMM: Risks Valuation Tool. It includes in addition, other tools that approach tasks like: to identify the impact of the risk valuation in the company, to measure the threats and the vulnerabilities, to identify risks and justifying the required controls, based in the risk valuation. Within the advantages of this tool, the developers argue'" that it has an excellent capacity to determine requirements for specific controls like: Authentication Level, Encriptation and Hardware Protection, to identify security functional requirements required by the new application, to develop security requirements, evaluation of a security atmosphere, among others. Cigital's SQM Solutions: Cigital Software Quality Management, was created under the motto "To identify and to eliminate software security defects during the software development and it test" the product Cigital SQM tries to offer a new series of solutions and services for software quality developed around innovating products. In addition, this tool combines the risks prevention, software measurement and software process improvement to help the companies to lead the cost of the quality software development." SecureUML: It is done on the UML base (Unified Modeling Language). This tool considers the advantages to integrate security engineering in the software ^ http://books.slashdot.org/article.pl?sid=05/11/21/1442228 ^ http://pluralsight.com/wiki/defaull.aspx/Keith.GuideBook/What%20Is%20A%20Security%20Principal.hlml http://www.esecurityplanet.com/views/article.php/3417561 'http://www.cedarlug.org/article.php?story=2004040617250150 "'http://www.insight.co.uk/files/datasheets/CRAMM%20(Datasheet).pdf http ://www.cigital.com/news/index.php?pg=art&artid=l 10

36

Jose Carrillo Verdunl, Gloria Gasca Hurtadol, Edmundo Tovar Carol and Vianca Vega Zepeda2

development life cycle, with the purpose of facilitating the mature security development beyond avoiding the infraction of the security policies. '^ UMLSec: Its objective is to raise an approach based on UML (Unified Modeling Language) it allows to express the information related to the security by means of diagrams in the system specification. Therefore UMLsec is defined under the UML profile, in particular when associating the security restrictions of a software design, references to a formal semantics of a simplified UML fragment". Failure Mode and Effect Analysis (FMEA): It is a methodology to analyze and to discover all the potential system error ways, its effects and how to correct or to mitigate these failures. It is the analysis procedure more used in the initial stages of the systems development like Conceptual Design stage''', nevertheless there are authors like Rex Black that considers the possibility and utility of this tool to eliminate all the potential system failures, therefore they focus it in the Testing stage. It is a specific methodology to value the system, the design, the process, or the service in the different possible ways in that the failures (problems, errors, risks, consequences) can happen [16]. Pilar: The risks analysis and management methodology Magerit (section 3) in its second version'', is accompanied by the risks analysis and management tool PILAR, elaborated by the National Cryptoanalytic Center and the Spain Public Administrations Ministry; it allows to define the assets and threats of an information and communications system, with object to determine its safeguard that allow to reduce the risk to which is put under the system'^. PILAR constitutes a tools set that supports to the information system risks analysis and management, following the Magerit 1.0 methodology and that at the present time offers: a) Pilar-1: qualitative analysis, before entering a detailed quantitative analysis. b) Pilar-2: detailed quantitative analysis, with the purpose of obtaining results of the investment recovery in its safeguard, in terms of declining risk'^.

5. Risk Analysis Tools Comparative The following table shows a classification and comparison of the described tools. This classification uses some criteria proposed by McGraw (Column Type) and others defined by the authors of this article (Column Security). The criterion "Type" indicates the classification given by McGraw in [5]. In the comparative that appears it indicates the objective that looked for to reach at the time of its development: • Commercial: Those methodologies done with an aim to commercialize it like support to certain task within the software development.

http://www.foundstone.com/resources/whitepapers/wp_secureuml.pdf http://www4.in.tum.de/~juerjens/papers/uml02.pdf '"* http://www.nepss.org/presentations/dfr9.pdf '^ http://www.revistasic.com/revista64/propuestas_64.htm "^ http://www.boe.es^oe/dias/2004/l l/23/pdfs/A38750-38750.pdf " http://www.ccn.cni.es/medidas_tecnicas/herramientas.htm

The risks analysis like a practice of secure software development. A revision of models and methodologies

37

• Standards: They are tools, standards or methodologies done by official institutions and proposals like standards of risk analysis. • Security: It has been catalogued because they have been thought under the criteria of software security or secure software, is to say that the security aspects are the main objective to support within the development of the risk analysis. The criterion "Security", determined by the authors of this investigation, looks for to categorizar the methodologies and tools considering the support levels that can offer these methodologies in the security requirements analysis for the software development, from a low level at a high level, of the following form: **: Low Level ***: Mean level ****: High Level *****: Very High Level Table 1. Risks Analysis Methodologies Tool or Metodology Microsoft's STRIDE Sun's ACSM/SAR ASSET Siemerns CRAMM Cigital's SQM Solutions SecureUML UMLSec Pilar Failure Mode and Effect Analysis (FMEA)

and Tools Classification Type Comercial Comercial Comercial - Standard Comercial Comercial-Security Comercial- Security Comercial- Security Standard Security

Security ^H^sfi*

*** *** *** ***** **** **** ** ****

Of this form, the Low Level indicates that the mentioned methodology or tool allows to make an risk analysis, but that its philosophy has not been thought directly in analysis of software security aspects, whereas the Very High Level, it will occur to a tool that has been constructed or raised under the philosophy of the software security aspects, considering the difference between security software and safe software (critical). When the table is analyzing, it can be observed that most of the risks analysis tools were not developed for its exclusive application in the software security development, but well, they are of general use. The approaches and strategies of security and risks evaluation in the organizations, have been focused like a necessity by the increasing incorporation of the information technology, although it is certain, the software products are part of this technology, at the time of making the risks analysis, would be due to incorporate particular considerations, as threats and typical attacks that frequently happen, and also the vulnerabilities generated by errors or negligences in the design and implementation of these products. The objective to describe the security aspects of the methodologies mentioned, is to focus future research works directed to support the Risk analysis like a good practice within the life cycle, framed in the proposal of figure 1.

38

Jose Carrillo Verdunl, Gloria Gasca Hurtadol, Edmundo Tovar Carol and Vianca Vega Zepeda2

6 Conclusions The importance of Risk Analysis in the early stages of the software development life cycle, like it has been showed previously; it extends from the product quality to the security and evolve to such an extent that wakes up the interest of the business in aspects like costs and investment return. In the security scope, if the requirements and necessities of an organization are not considered from the early stages of the software development life cycle and these are not evaluated in the other development stages, hardly it will be obtained a system robust, able to repulse the attacks so common in the present time. Every day the organizations take more serious the security problems, and this is demonstrated with the different initiatives taken to do that the software developers become aware from the importance of improving their processes, incorporating practical that they look for to reach the security product implementation, proactive to the attacks. The necessity to incorporate the study and application of the security software life cycle under the standards parameters and associated quality models to good practices, with the purpose of having developments able to respond and to face the attacks and the systems attackers, it is complemented with the preoccupation of the industry, the academy and the commerce giving as result variety of efforts in the search to raise solutions to this problem. The study and the Risk Analysis Tools comparative made present the beginning of the investigation that are developing the authors of the present article, leaving laid the way to investigate thorough the methodologies, tools, standards and principles to establish development models with practices and evaluations at the right moment to guarantee the quality, evaluating in first instance the security in the software development. Mainly the study to the practices raised by McGraw, shown in fig 1, for the security software development is left open.

References 1.

2. 3. 4. 5. 6.

N. Davis, W. Humphrey, S. Redwine, G. Zibulski, and G. McGraw, "Processes for producing secure software," Security & Privacy Magazine IEEE, vol. 2, pp. 18 - 25 2004. G. McGraw, "Software Security," IEEE Security & Privacity, pp. 80-83, 2004. B. R., "The Risks to System Quality Investing in Software Testing Series, Part 3." I. Sommerville, "Ingenieria de Software," P. Education, Ed., 6 ed. Mexico, 2002. D. M. Verdon, G., "Risk analysis in software design," lEEESecurity & Privacy Magazine, vol. 2, pp. 79-84, 2004. G. McGraw, "From the ground up: the DIMACS software security workshop," IEEE Security & Privacy Magazine, vol. l,pp. 59-66, 2003.

The risks analysis like a practice of secure software development. A revision of models and methodologies

7. 8. 9.

10.

11. 12.

13. 14. 15.

16.

39

B. M. Potter, G., "Software security testing," lEEESecurity & Privacy Magazine, vol. 2, pp. 81-85, 2004. J. A. Whittaker, "Software's invisible users," IEEE Software, vol. 19,pp. 84-88, 2001. H. W. a. C. Wang, "Taxonomy of security considerations and software quality," Communications of the ACM, vol. 46, pp. 75 - 78, 2003. K. R. M. Van Wyk, G., "Bridging the gap between software development and information security," Security & Privacy Magazine IEEE, vol. 3, pp. 75 - 79, 2005. G. E. McGraw, "Risk Management Framework (RMF)," Cigital, Inc., 2005. C. Alberts, Dorofee, A., Stevens, J., Woody, C , "Introduction to the OCTAVE Approach," vol. Software Engineering Institute, 2003. C. Alberts and A. Dorofee, Managing Information Security Risk. The OCTAVE Approach: Addison Wesley, 2005. J. Manas, "Pilar. Herramientas para el Analisis y la Gestion de Riesgos," 2004. D. P. P. Gilliam, J.D.; Kelly, J.C; Bishop, M.;, "Reducing software security risk through an integrated approach," Software Engineering Workshop, 2001. Proceedings. 26th Annual NASA Goddard, pp. 36 - 42 2001. H., Failure Mode and Effect Analysis. FMEA from Theory to Execution, Second Edition ed.

P3P Semantic Checker of Site Behaviours Robson Eduardo Grande' and Sergio Donizetti Zorzo Federal University of Sao Carlos, Computing Department Zip Code 676 - 13565-905, Sao Carlos, Brazil {robson_grande,zorzo}@dc.ufscar.br, WWW home page: http://www.de.ufscar.br

Abstract. The interactive use of the web between users and service providers introduces a privacy problem that involves the undesired disclosing of user personal information, mainly with the presence of personalization that needs this type of information. Also there are many manners to face it, but the Platform for Privacy Preferences (P3P) is one that provides a variable level of privacy for the user's browsing. However, the P3P only introduces a privacy contract between the site and the user, without guarantees that it will be obeyed by the site. Then a semantic checker can be added to the P3P architecture to compare the contract with the site attitude and to increase the trustworthiness on the P3P contract. Some experiments are accomplished and the results are displayed to show the present situation of the privacy policies of the sites, and we discuss what it implies in the data gathering and what is gained with the use of the semantic checker.

1

Introduction

The interface implementation in e-commerce applications must consider two aspects: the marketing necessities and the user privacy. For both aspects user's personal data has a great worth. On one side, providing competitive advantages in the market through the marketing and, on the other hand, presenting a bigger user confidence with regard to his disclosed data. This user confidence is recognized as an important item to bring to the success of an online marketing, and consequently to increase purchases and sales in the web and to improve the e-commerce markets. The personalization application is one of the strongest competitive advantages in the market. It has become an indispensable instrument to the progress of the services and online businesses. The idea of receiving personalized services from visited web sites is sufficiently attractive, besides very well accepted by the users. In accordance with Kobsa [1], clients need to feel that possess a personal and unique relationship ' Robson Eduardo Grande receives financial support from CAPES.

Please use the following format when citing this chapter: Grande, R.E., Zorzo, S.D., 2006, in IFIP International Federation for Information Processing, Volume 213, Network Control and Engineering for QoS, Security, and Mobility, V, ed. Gaiti, D., (Boston: Springer), pp. 41-53.

42

Robson Eduardo Grande and Sergio Donizetti Zorzo

with the enterprises, and to confirm this is presented a research that shows that sites offering personalized services achieved an increase of 47% in the number of new clients. Meanwhile, so that personalization to be applied it is necessary the information collection originated in several provenance, which can be gotten explicitly or implicitly. An individual that sends explicitly information is obviously aware of the sending of it. On the other hand, the implicit gathering of information is the resultant data acquisition from the user browsing observation, and he can be or not aware of its existence. Information obtained by this method contemplates the e-commerce interaction data and the clickstream [2] [3] data, which makes possible the creation of user profiles based in user interests, browsing patterns, preferences and others. But, while the user data gathering can help in the marketing of e-commerce sites, it can prejudice the marketing too. Depending on the form that the gathering method and analysis process of user data are accomplished it can characterize a privacy invasion, whereas the user can loose the control of his personal information [4]. This privacy lack results to a user confidence loss, as from this he stops accessing certain services fearing that personal information, which has a considerable value for him, is disclosed or has a malicious use. This can be confirmed by Teltzrow [5] that says 64% of web users haven't accessed some time a web site, or they haven't bought something from it because they don't know how their information would be used. Also 53% of the users don't trust in commercial web sites that gather data, 66% of them don't register in online sites fearing that their information may be used inappropriately, and 40% of them falsify data when registering online [6]. Moreover, privacy is considered to be intrinsically related with the control that an individual has over determined information [4]. In this way, it must be inherent in trustworthy transactions, in another way a privacy lack will contribute to cause a fault of the business model of the electronic commerce. An increase of the user control perception causes an increase of adoption of services and products based on the web. The user control perception is provided by bigger information disclosing of the collected data use that is made, and the receiving of something worthy in return stimulates the data disclosing by the user. Jutla [6] reports that 51 % of web users desire to disclose personal data to receive something worthy in return and, a research shows that 90% of users want to be asked after permission before their information is used or gathered [5]. The question is to find an equilibrium point between personal information gathering and user privacy. Nevertheless, to find this equilibrium point becomes difficult because the privacy is subjective, in this case each one has its privacy discernment. Several mechanisms utilized to guarantee the user privacy have consequences in their access form, producing degrees of reachable personahzation. In this way they can denigrate the personalized service availableness. The 3P Platform, that have been used in a pretty crescent and extensive way [7], is interesting to become possible the privacy level modulation in accordance with the user preferences, and in this way adapting better to the user characteristics. Also, to the use of this platform isn't necessary to make many modifications, since basically

P3P Semantic Checker of Site Behaviours

43

it includes an automatic method of privacy policy reading. Add to that, the privacy policies have a big user acceptance, 76% of users think privacy policies are very important and 55% of them believe that it turns the personal information disclosing more comfortable [5]. Notwithstanding, this platform presents a low level of trustworthiness in the semantic aspects of the manipulated data. In this manner, it is proposed a semantic checker looking at the increment of the trustworthiness degree in the P3P tool. The user trustworthiness is incremented by comparing the P3P privacy policies with the site's behavior. Tests are accomplished and their results show that some sites write P3P policies correctly, and the inclusion of the checker can obey the other sites to improve the construction of their policies. This work introduces in the second section several access forms to the user data with privacy. In the third section we present the 3P platform mechanisms and its limitations. The fourth section presents the Semantic Analyzer. The fifth section shows the experiments and results obtained and finally the sixth section describes the conclusions and future works.

2 Privacy Mechanisms As manners to face the problem of privacy in the web, many proposals exist that can be divided in two basic forms of approach. One of these forms aims at the introduction of architectures or mechanisms, tries to keep the anonymity of the user, or makes difficult the identification of him. The next mechanisms follow this line of approach. Cookie crushers or cookie filters are the most common of them. They provide a way of controlling or not permitting the cookie existence in the user computer, avoiding that personal information can be stored to be recovered subsequently. Theoretically cookie [8] is used to store in the user computer the estate of his browsing in a determined site. The cookie content is created by web server. The sites utilize this information piece to characterize the user profile, gathered through analysis methods of browsing as clickstream. Clickstream, also known as clickpaths, is the route that the user chooses when he clicks or browses by a site. This information is used to determine user profile in his browsing. The anonymity is wanted by several users that don't permit that any personal information is discovered, thus avoiding any privacy problem and identification of the user identity. Three mechanisms are presented as examples of this type of approach. Anonymizer [9] is a web proxy that forwards the user requisitions and applies certain methods to mask them as requisitions from the proxy. Onion Routing [10] is constituted of one or more routers and each one works as a proxy that applies certain methods to improve the privacy and to forward randomly to the next router or to the destiny site in question. This routers net is built dynamically, it is fault tolerant and works to avoid eavesdroppers by making difficult to determine the user requisitions source.

44

Robson Eduardo Grande and Sergio Donizetti Zorzo

In Crowds [11], each user contributes hiding the real origin of a requisition, with the member co-operation of a group. Randomly and dynamically a requisition can be forwarded to a member of a Crowd group or to the site destiny, and it isn't possible to make backtracking search to determine the origin user because each user requisition changes the routing process to create a different path. Another approach to permit privacy during the user browsing is using pseudonyms. It consists basically in to create fictitious names to users to disguise the user identity permitting personalization, as soon as web sites are able to determine user profiles without link them to the user real identity. An example of this type of mechanism is the JPWA (Janus Personalized Web Anonymizer) [12]. It acts as an intermediary entity (proxy) between the user and the web site generating automatically nicknames when users want to access determined services, executing the authentication process. If the real identity of a pseudonym is discovered, all the user actions in the past will be automatically exposed. Managing Anonymity while Sharing Knowledge to Servers (MASKS) [13] is another approach to protect the user privacy permitting personalization based in the pseudonyms idea. It hides the user identity under masks or pseudonyms. These pseudonyms are associated by some way to a group of similar requisitions. These groups are defined in accordance with user interests exhibited during the interaction with a web service by making requisitions in name of a group, contrary to an individual user, thus not disclosing the user identity. The user requisition is designed to a group and not to a user because the requisition represents the user interest in a specific moment. The MASKS doesn't provide privacy when users send explicitly their information to sites. All the presented mechanisms show some limitations in preserving the privacy or permitting personalization. Those mechanisms that protect all the user privacy don't permit personalization, and those that permit personalization have faults to protect the user privacy, or they have some problems in the security aspects.

3 P3P Another line of approach introduces the idea to police the sites or to inform the user about the privacy policies that are adopted by them, communicating the information that is gathered. According to this criterion are presented the following systems. One of them is a tool that provides information related to context about privacy and personalization options [14]. It is a support system to the user navigation exhibiting a situational communication dialogue when the user information is gathered. P3P [15] [16] inserts a way to manage the user browsing through of a standardized method to disclose how the user information is gathered, how they will be utilized and the sharing of them to third parts. This management is made through the P3P privacy policy checking by a user agent. P3P inserts a contract between sites and users, defining a protocol that permits the site administrators to publish a site privacy policy. Add to that, a user agent is defined by the platform that reads automatically this privacy police, verifying if it

P3P Semantic Checker of Site Behaviours

45

combines with the user privacy preferences or user security configurations, because the majority of the users pay attention poorly to the privacy policy readings [5]. Web sites are qualified to express their privacy actions by the 3P platform in a standard format. This standard format consists in indications made and based in the P3P vocabulary to express the privacy behavior of each web site. These indications are made by a XML codification with name spaces from P3P vocabulary to provide information that defines the site privacy policies, informing which information is obtaining and which form is using to obtain it, where and how long the information will be stored, who is the responsible and the information gathering purpose. The P3P vocabulary e planed to be descriptive of the site behavior, but not to be simply an obedience indicator to a particular law or a conduct code. The privacy policies of a site must have a reference with their respective and specific particularities, permitting to determine the policy range in determined site region. The policy reference is a codification in XML with name spaces that can specify the policy to an entire site, portions of a site or to a unique web document. It also links the site parts to its respective policies, shows the exact location of the file that contains the P3P privacy policies, defines the access methods to which the policy is applicable and the time period to which it claim that is considered to be valid. By any means the P3P reference file location must be known to find the file, to begin the analysis, and to know the P3P privacy policy location. To his, four mechanisms can be used to indicate the policy reference file place: a well known locaUon (/w3c/p3p.xml), HTTP headers can be used to point to a policy reference file through the creation of a new answer header, a HTML or SHTML link tag can be used to obtain the policy reference file. The user preferences inform the way how the user agent must act when analyzing a privacy policy of a site. The user P3P agent works as a tool that acts co-operating with the browser. It can be a plug-in added to the browser, a proxy server, or built in the web browsers. The user agent looks for a reference of a policy reference file in the HTTP header, HTML or SHTMLK link tags and by the well known location. With the reference file the agent can obtain the privacy policy respective to the URL the user requested and can begin to analyze the policy by comparing it with the user privacy preferences. This analysis process results in an indication with symbols, sounds or generating alerts to the user. P3P Limitations According to the P3P specification there is one limitation. It's argued that the user should have control of his privacy instead of to trust completely in privacy policies of web sites [13]. Add to that, this is a great problem with the P3P because it can't guarantee sites will act following their policies, considering that P3P is only a document describing the privacy policy of a site. In this way the site can be obtaining additional data that is specified by the privacy policy, and the user doesn't have guarantees of what information is collected. Add to that, this is passed in way that the user doesn't perceive, whereas

46

Robson Eduardo Grande and Sergio Donizetti Zorzo

he trusts on the signalizing of the user agent that makes the automatic policy analysis. Laws and auto-regulatory programs that protect the user privacy can be verified during the P3P policy assimilation, and, thus imposing certain obedience to the policy correctness related to the site. Such laws are only a way to influence web sites to be sincere in the building of its policies. However, these laws don't guarantee that every web site will apply it. To guarantee that the P3P policies are obeyed is necessary to insert some checker that can't be handled by the sites, it executes a verification of the privacy policy faithfulness considering the sites behavior, and returns a guarantee seal.

4

P3P Semantic Checker

The Semantic Checker presented in this work objectifies to extend the 3P Platform. It adds a bigger trustworthiness to the user browsing by the conference of the privacy policy correctness proposed by the 3P platform. The conference of the privacy policy correctness is made by inserting a semantic analyzer to the P3P agent user that makes a P3P privacy policy checking. This checking is made comparing the site behavior with it privacy policy, and this behavior is represented by the site source code that comes to the user browser. It must be localized in the user computer, trying to increase the security of this checker proposed. With this guarantee that the site doesn't have access to the checker and, thus the site can't corrupt it to produce a false result to the user. If it produces a false result it will be deceiving the user, coming back to the original situation where there weren't privacy guarantees. After that the user information is collected there isn't possibility of knowing the destiny that will be given to it. Thus, the privacy policy checking with the site behavior is only possible at the verification of user data gathering, and without this approach only rests the trustworthiness on the privacy policy as the unique way of to police the site attitudes with the collected information, or to belief on the law codes [16]. At the implicit gathering, the information collectors utilize ways that can't be identified by some mechanic analysis method, or they don't follow a pattern to be identified. The cookies can be identified, seeing that they are stored in the user computer through a http requisition. However, they aren't a form of information gathering, but a form of storage of information gathered, and their content can't be understood. The analysis of explicit gathering is the way that better shows the site behavior at the user computer view. This type of gathering can be observed in the html page source code that the user accesses. The data requisition, which is made to the users, is accomplished by html elements of data entrance. Also, the html code is very used to the construction of Web pages, it is generated by the majority of languages of dynamic pages as ASP, PHP, JSP and others, and it is embedded in the JavaScript code.

P3P Semantic Checker of Site Behaviours

47

To find the places where the user information is obtained is necessary to look for by the form tags in the page source code in question. Each data entrance field in each form in the site source code represents a data entrance that the user can enter his information to be sent to the site, and the set of these input fields results in the information set that the user send explicitly to the site. To accomplish the analysis is necessary to find each one of these data entrance fields e to compare with the respective P3P policy to verify if, through the page, the site is obtaining some information over that the policy specifies. The checker can be added as a module to the user agent, accomplishing the checking every time that the user does a page requisition, which can be visualized by the figure 1, In the figure the first communication that is accomplished with the site server is to obtain the privacy policy, with it the agent can make the comparison with the user preferences. In the second communication the server sends the requested page, and the semantic checker accomplishes the analysis with the source code of this page and the P3P privacy policy. The privacy policy validation can be made before or after that the agent makes the comparison between the policy and the user preferences, resulting in an additional signalization to the user or even to influence the result that the agent signalizes. Therefore the semantic checker functioning is made of the following form, incorporated at the 3P platform, which can be visualized by the figure 1.

User Agent

(6)

*-

m

Server

Fig. 1. A Diagram that represents the insertion of the semantic checker to the P3P Platform architecture.

In a page requisition made by the user in his browser (1) in an architecture that uses P3P, the user agent intercepts the requisition (2). Initially it looks for (3) (4) a P3P privacy policy to analyze the site policies with the user preferences (5). With the analysis made, the agent can signahze to the user positively (11), permitting that the user can access the page (6) (7) (10) (12), or negatively, letting to the user to take the decision in accessing or not the page.

48

Robson Eduardo Grande and Sergio Donizetti Zorzo

The checker makes a semantic analysis with the privacy policy obtained (5) and the source code (8). By this analysis is created a signalization that can be incorporated to the signalization that the user agent produces (11), or can be refined by the agent as an additional criterion in its policy analysis process (9). A functioning architecture of semantic checker is presented by the figure 2. At it, three entrances can be identified, html source code file and the respective URL (1), privacy policy reference file (2) and P3P privacy policy file (3).

Semantic Validator Cofiioarator

t

(1) {2)

(11)

Analyser

(3)

(4)

(6)

(8)

^ Poi:ce Analyser

HTML At^alyser

Reference An;jiyser

I" m

Lexical Anal/Sar

(5)

Fig. 2. Semantic Checker Architecture and functioning - through the html source code analysis of the site and of its privacy policy is generated a result to the policy approbation.

By the entrances at the figure 2 will be begun the policy analysis by the Analyzer. First is necessary to find the respective page privacy policy according to its URL (4), to this is utilized a lexicon analyzer to recognize the reference file elements (5). At the end of this process it is returned the policy name that must be used. Determined the respective policy, the data entrance elements are obtained, which are identified by the input fields (6). Also it is used the lexicon analyzer to recognize

P3P Semantic Checker of Site Behaviours

49

the html elements and to be able to found them (7). The privacy policy data elements also will be obtained (8) using a lexicon analyzer to identify them by the data fields. Obtained the both elements, is accomplished a comparison of each input field of the html source code with the privacy policy elements to investigate is the field is specified by the policy (10). Depending on this comparison made, a negative or positive result can be returned (11). The figure 3 presents a sequence diagram of a user's page requisition. The sixth arrow represents the semantic checker action added to the P3P, and the others arrows represent the user requisitions and the P3P answers without the checker functioning inclusion. Add to that, each information entrance field needs to be delimited by the site privacy policy, and the fields of data entrance in the site source code needs to have some binding with the respective elements of its P3P specification, which in the case of this initial implementation, the link is the html field to have a name equals to the P3P policy specification.

User Side

Server Side

User

User Agent

1; Requests pageO 2: Requests ttie site police reference fileQ

^ 3: Returns the police reference fileQ

4: Requests the site privacy policie fileQ

5: Returns the privacy policie fiieQ

P F-

6: Compares the privacy police wiVr\ the source codeO

Compares the privacy police with the user preferencesO

T

^

8: Returns the requested pageQ

T

Fig. 3. Sequence diagram of an example of semantic checker execution in a page requisition.

However, this proposed link between names restrings the page construction. But, the proposal suggested is initial and utilized more to test. A proposal more suitable is to create an attribution file together with the P3P policy to be utilized to accomplish

50

Robson Eduardo Grande and Sergio Donizetti Zorzo

the verification of the input fields. This additional brings flexibility to the owners of the sites at the creation of entrance fields.

5 Experiments and Results The experiments are accomplished trying to present a situation of how the sites and their respective P3P privacy policies are. The research consisted in to make a process closed to the mechanism of the semantic checker, obtaining each source code of each page and its respective privacy policy. It was made a comparison between the data element names of the policy and the input element names of the page, signalizing if some element wasn't delimited by the policy. The result of the automatic analysis was the same as the result that was hoped, no one page that had text entrance elements and was analyzed passed by the verification with positive signalization, whereas the analysis is based in the comparison of names. But, in a manual analysis of the gathered data some evidences could be observed. This manual analysis consists in to observe the input elements obtained with their respective data elements. In this observation was approached also the comparison between the name means of the gathered input fields and the means of the data elements obtained, and thus to try understand how was constructed the privacy policy and the site page to relate them in some way. Initially were accessed 100 compliant sites with the 3P Platform. The addresses of these sites were obtained from a listing in http://www.w3.org/P3P/compliant_site. In a sampling of 100 sites only 57 could be analyzed, the others 43 had some problem that made impossible their access or the use of their P3P privacy policy: the site was in construction, it wasn't found, the access was forbidden, there were problems in the syntactic construction of the P3P policies, the policies weren't found or the policy reference files weren't found, seeing that the reference file was looked for in the well known location. With these 57 correct sites 120 pages were obtained so that their html source codes were analyzed. By the analysis, 33 pages of 120 didn't have any input element of data entrance, and thus they weren't utilized to the verification. Therefore, with a sampling of 87 pages was obtained the following graphic presented in figure 4. The research only approaches the explicit information gathering, the dynamic data specification [16] wasn't considered, as dynamic.http, dynamic.clickstream or dynamic.cookies. The cookie content doesn't follow a construction pattern: each site builds it in a different way, needing knowledge of all site behavior and source code to predict its value. The 87 pages were classified in six categories, in accordance with how they presented their privacy policies, and each category represents a percentage of the 87 pages. The "A" category delimits the pages that have a P3P privacy police and doesn't describe any one of their input fields of their html source codes.

P3P Semantic Checker of Site Behaviours

51

The "B" category delimits the pages that have policies specified in a generic way all or a big part of their input fields. It describes only what is made with any data that is collected by the page, or also it can be a generic specification as user.business-info or user.home-info. The "C" category delimits the pages that have a privacy policy that specifies each input element of the form in their html codes. The "D" category delimits the pages that have privacy policy that specifies only some input fields of the source code. The "E" category delimits the pages that have names of input fields in the html code that their meaning can't be understood or they have a very generic meaning, as loesungl, sp-q or word. The "F" category delimits the pages that have some input field names in the html code that can be understood and they are specified by the privacy policy.

BA

BB

QC

an

Fig. 4. Graphic that presents the experiment results classified in categories of P3P privacy policy situation.

Also it was observed that the majority of the pages, close to the totality, specified the dynamic data gathering. Even to those policies that informed nothing to the explicit data gathering. This evidences that the P3P compliant sites are aware in specify the implicit information gathering, but they specify poorly the input fields at html source code. Therefore, in general terms can be concluded that 44.82 percent of the pages, almost half of the pages that utilize the 3P platform specify with more details in majority of their fields of explicit information gathering. This shows that the mechanism can be used as a tool to improve the user trustworthiness by verifying.

52

6

Robson Eduardo Grande and Sergio Donizetti 2k)rzo

Conclusions

Among all the experiment results made, it can be observed that the totality of the sites compliant with the P3P policy don't satisfy the restrictions to the execution of the checker. It was also observed that more than half of the sampling of these 100 sites complaints with the 3P platform don't look for to specify in detail the data that is obtain from the users. The insertion of this checker in the 3P platform increases the user trustworthiness guaranteeing that all the data that is gathered explicitly is specified by the P3P privacy policy. The checker would be an additional reinforcement to the sites that use P3P and detail their specification of data gathering, and would force the others to detail the elements of the information gathered. Thus, over increasing the trustworthiness in the privacy policies, also would improve the construction of the P3P policies, with more details in the site specifications. The next step is to improve the process of checking by retiring the restriction that each html entrance field must have the same name as in its respective P3P privacy policy, this can be made by using a file stored together with the privacy policy that makes the linking between the names, as suggested before. As evidenced, this proposal considers the explicit data gathering, which is analyzed in the site source code. However a cookie analysis can be added to the checking process, the cookie presence is identified by the HTTP communication, but its content can't be understood or analyzed.

References 1. A. Kobsa (2001). Tailoring privacy to user's needs. Proc. Of 8th International Conference on User Modeling. http://www.ics.uci.edu/~kobsa/papers/2001-UM01kobsa.pdf. 2. R. E. Bucklin, J. M. Lattin, A. Ansari, D. Bell, E. Coupey, S. Gupta, J. D. C. Little, C. Mela, A. Montgomery, J. Steckel, "Choice and the Internet: from Clickstream to Research Stream", U.C. Berkeley 5* Invitational Choice Symposium, Mareting Letters, 13(3), 245 -258, Last Revised February 10, 2002. 3. A. L. Montgomery, S. Li, K. Srinivasan, and J. C. Liechty, (2004) "Modeling ONline Browsing and Path Analysis Using Clickstream Data", Marketing Science, Vol 23, No. 4, p579-595. 4. Privacilla, (October II, 2005); http://www.privacilla.org. 5. M. Teltzrow and A. Kobsa (2004) "Communication of Privacy and Personalization in E-Business". Proceedings of the Workshop "WHOLES: A Multiple View of Individual Privacy in a Networked World", Stockholm, Sweden. http://www.ics.uci.edu/~kobsa/papers/2004-WHOLES-kobsa.pdf.

P3P Semantic Checker of Site Behaviours

53

6. D. Jutla, and P. Bodorik, (2003) "A Client-Side Model for Electronic Privacy". 16'*' Bled eCommerce Conference and Transformation. June 2003. 7. P. Kumaraguru, and P. Cranor, "Privacy in India: Attitudes and Awareness". In Proceedings of the 2005 Workshop on Privacy Enhancing Technologies (PET2005), 30 May - 1 June 2005, Dubrovnik, Croatia. 8. D. Kristol, and L. Montulli, "HTTP State Management Mechanism". Bell Laboratories, Lucent Technologies. Epinions.com, Inc. October 2000. RFC 2965. http://www.ietf.org/rfc/rfc2965.txt. 9. Anonymizer, Inc. (2004) "Anonymizer Enterprise Network Privacy/Security Appliance". Technology Overview, www.anonymizer.com. 10. D. Goldschlag, M. Reedy, and P. Syversony, (1999) "Onion Routing for Anonymous and Private Internet Connectinos". January 1999. www.onionrouter.net/Publications/CACM-1999.pdf. 11. M. K. Reiter, and A. D. Rubin, (1997) "Crowds: Anonymity for Web Transactions". AT&T Labs - Research, avirubin.com/crowds.pdf. 12. E. Gabber, P. E. Gibbons, Y. Matias, and A. Mayer (1997) "How to Make Personalized Web Browsing Simple, Secure, and Anonymous". Bell Laboratiories, Lucent Technologies, http://www.bell-labs.com/project/lpwa/papers.html. 13. B. G. Rocha, V. A. F. Almeida, L. Ishitani, and W. Meira Jr., (2002) "Disclosing Users' Data in an Environment that Preserves Privacy". Workshop On Privacy In The Electronic Society. 14. A. Kobsa, and M. Teltzrow, (2005). "Contextualized Communication of Privacy Practices and Personalization Benefits: Impacts on Users' Data Sharing and Purchase Behavior". PET 2004. 15. L. F. Cranor, (2003) "'I Didn't Buy it for Myself Privacy and Ecommerce Personalization", WPES'03 (Washington DC, USA, October 30, 2003), AT&T Labs-Research. 16. Platform for Privacy http://www.w3.org/P3P/.

Preferences

Project,

P3P

Public

Overview.

A Sliding Window Based Management Traffic Clustering Algorithm for 802.11 WLAN Intrusion Detection Wenzhe Zhou', Alan Marshall', ,and Qiang Gu^ 1 School of Electrical & Electronic Engineering, Queen's University, Belfast, UK {w.zhou, a.marshall}@ee.qub.ac.uk 2 ECU, Queen's University, Belfast, UK qiang.gu@ee,qub.ac.uk

Abstract. This paper introduces a novel Management Traffic Clustering Algorithm (MTCA) based on a sliding window methodology for intrusion detection in 802.11 networks Active attacks and other network events such as scanning, joining and leaving in 802.11 WLANs can be observed by clustering the management frames in the MAC Layer. The new algorithm is based on a sliding window and measures the similarity of management frames within a certain period by calculating their variance. Through filtering out certain management frames, clusters are recognized from the discrete distribution of the variance of the management traffic load. Two parameters determine the accuracy and robustness of the algorithm; the Sample Interval and the Window Size of the sliding window. Extensive tests and comparisons between different sets of Sample Intervals and Window Sizes have been carried out. From analysis of the results, recommendations on what are the most appropriate values for these two parameters in various scenarios are presented.

1

Introduction

Today 802.11 WLANs are widely used in different areas such as home, enterprise, and military due to their convenient nature. However, attacks against 802.11 WLANs are more feasible than against fixed networks as malicious users can easily access the wireless links. Furthermore, research has shown that the security mechanisms such as WEP, WPA and 802.Hi provided to protect the WLAN MAC Layer are not completely safe [1] [2] [3]. Even the newly ratified 802.Hi standard [4] is vulnerable to certain acfive attacks such as Denial-of-Service (DoS) and ManIn-The-Middle (MITM) due to the unencrypted management frames and EAPOL (Extensible Authentication Protocol Over Local Area Network) frames [5].

Please use the following format when citing this chapter: Zhou, W., Marshall, A., Gu, Q., 2006, in IFIP International Federation for Information Processing, Volume 213, Network Control and Engineering for QoS, Security, and Mobility, V, ed. Gaiti, D., (Boston: Springer), pp. 55-64.

56

Wenzhe Zhoul, Alan Marshall 1, ,and Qiang Gu2

Expert security systems are essential in order to address the vulnerabilities of 802.11 WLANs. During the past decade, data mining approaches have been used to improve security because they have the advantage of discovering useful knowledge that describes a user's or program's behaviour from large audit data sets. A good example is intrusion detection, which has been used to protect computer systems as a first line of defense. Next generation Intrusion Detection Expert Systems (NIDES) represents an IDS based on statistics that measures the similarity between a subject's long-term and short-term behaviours [8]. In [9] S.Chebrolu applied Bayesian Networks (BN) and Classification and Regression Trees (CART) approaches in fixed networks to model Intrusion Detection Systems (IDS) with high accuracies of detecting certain intrusions. In [10] C.Kruegel implemented the Bayesian Network approach in IDS to reduce false alarms. To date these approaches have not been applied to implement IDS in the lower protocol layers of WLANs. Recent research has shown that active attacks exhibit certain fingerprints in terms of the patterns of management frames [6]. By clustering and analyzing certain features of the management traffic (e.g. frame types, source/destination addresses) in the network, an intrusion detection system can recognize and predict the abnormal events. This paper focuses on the clustering of the 802.11 management frames. Our work contributes in three ways: firstly, it specifically addresses the security issues in 802.11 WLANs and uses the characterisfic features of management traffic to analyze intrusions; secondly, our algorithm statistically measures the similarity of the management traffic clusters between a long-term and a short-term performance. This meets the requirements of the NIDES systems. Thirdly, we perform a series of test to decide the most appropriate parameters (window size and sample interval) and their optimum values for cluster recognition. This paper is organized as the following: section 2 introduces the background theory and experiment set-up; section 3 introduces the sliding window algorithm for intrusion detection in 802.11 WLAN; secdon 4 analyzes the choice of parameters for the sliding window algorithm; secfion 5 gives the conclusion and future work.

2

Background & Challenges

The 802.11 management frames are responsible for the access control, which is expressed by the 802.11 state machine [7]. These management frames are: beacon, probe request, probe response, authentication, association request, association response, reassociation request, reassociation response, disassociation and deauthentication. When stations (STAs) search for connections, join or leave the WLAN, they send out management frames to the access point and negotiate about the access. Research shows that as events (e.g. scanning, joining, leaving, or an active attack) occur in the WLAN, corresponding clusters of management frames are formed [6]. Each event has an individual cluster pattern. By observing the management frame clusters, an IDS can detect the events in a WLAN, and by analysing the pattern of a cluster, the IDS can tell the type of event occurring. In this paper, we focus on how to detect the clusters. The challenges are: how to define the

A Sliding Window Based Management Traffic Clustering Algorithm for 802.11 WLAN Intrusion Detection

57

similarities of the clusters? How to decide the border of a cluster? And how to separate one cluster from another? We have set up a WLAN with five clients, one attacker and one sniffer to observe the traffic in the WLAN [6]. We injected two types of attacks into the network. Figure 1 shows the complete WLAN traffic trace. The trace file includes the following four events with six clusters: a link problem, a DoS attack, the DoS recovery, and an MITM attack.. From the figure we can see that when events occur, the number of management frames will increase. The "frame density" can be regarded as the number of frames in each time period. From a more abstract point of view, the change of the management frame density shows the occurance of events. Thus we introduce the variance of number of management frames in each sample time point to describe the similarities of the management frame clusters. The average number of frames A can be expressed as: ?„^'

0)

And the variance can be expressed as: I.(x.-^y

(2)

In the above two equations, Xi is the frame number in each sample time point, n is the total frame number during the chosen period of time. The observation of a cluster also includes the contrast between the "past" and the "present" management traffic density in the network. The comparison shows the change in density. The challenges are: (i) how to define the time period of the "past" and the "presenf ? This can be interpreted as how to decide the value of n in equations (1) and (2) and (ii) how to define the sampling time point. Another challenge is how to describe the comparison with a machine understandable language? In the following section, we introduce our Management Traffic Clustering Algorithm (MTCA), which is based on a sliding window approach.

58

Wenzhe Zhoul, Alan Marshall 1, ,and Qiang Gu2

jh^^./z W2_olass2 . , . _ U 4 " i j l a s s 2 — * - N e _ d E s 2 - ^ ~ N 8 _ o l s s s 2

• 2 3 4

6 e 7 8

9 m t1 12 13 14 1516 17 18 19 20 2122 23 24 2526

2 3

4 5

L

6 7

i

8 9 10 11)2 13 14 15 16 17 18 15 20 21 22 2324 252S

BV Total IMbfisl

BV ToUIIMbpsJ ABerage 6 V Reserved to Each Usei

1

2

3

4

S

8

7

9

10

11

12 13 14 15 BV Total [MbfisJ

18

17

13

20

21

22

23

24

25

26

Fig. 5. Mean BW reserved and mean PSNR provided to a single class. The available quality flows are: Q=4 and 8 (classO); Q=4, 8 and 16 (class 1); Q=8 and 16 {class!).

• cJassO D classl

Average PSNR

BolsssSj

«41' ?40,

i3!.

•^W-

V \Mm:

(0,0,71 (0,1,1)

(0,2,S) (0,3,4)

(04,3)

(0,S,2)

f- h 1- }- -"F j::

-•¥

(O.S,l| (07,0) S0,0,6)

|0,1,S)

(0,2.4) (0.3.3) (O.t.E)

(0.5,11 [0,£, ) (0,0.5)

(O.tJi

%

•

•

\

(0,2,3) (0.3,2)

(0,4,1)

(0.5,0)

hlumbK of Useis. {ClassO. Classl. CtassZ| Profit per £acft User

1

!o,e

T'" (0O7)

101,6)

T - '

102,6)

T"

(0.),4)

(06,2)

(06,1)

r

(07 0) (0.0,0) (0,1.5)

1

Yf 1

i:

ITM ....

(0,4 3)

| pdsrsO octrrsl

(0,2 4) (0.3,3) (0,4 2! (0,5,1)

(0,6 Q) (0,0,5)

i -

(01,4) (0,2,3)

DaKsi\

r |0,3,2)

(U,4,1) (0,5,0)

Number of Useis. fCUssO, Classt, ClassZ) TotalPrrrfil 6!

•

•

13-

t-

I (007)

n

n

n (

(0 I t )

(02,6)

(0 3,41 10 ,3)

(OS,!)

•

(OS,l)

11

iQf^venu? poosi apio(jt|

-

•

n. .

n ;

(07,0) (0,0,6) (0,1.5) (0,2.4) (0,3.3) (0.4,2) (0.5,1) Number oF Usets. (Classfi. Classt. ClassZ]

1Mw] i 11 •

(0,6,0) (00,6)

(0,1,4) (02,3)

(03,2)

(041)

(05,0)

Fig. 6. PSNR provided to a customer and service provider's profits. Users of classl and classl interact in the VoD system. There are 7, 6, 5 accepted users (from left to right).

Design of an Adaptive-Rate Video-Streaming Service with Different Classes of Users

flveiage

P5NR

gctassO

QcUisl

n

4t -

i: }-

»• 3 7 -

(1,0,5)

jt.'.43

'

?

1-

U.2.33

(',3.2}

n

§• 1 -

-v^

n.t.n aS.O) (2,0,43 (2.1,3) (2.2.2) f2,3,1) (2,4.01 (3,0,2) Number of Users. (CtassO. C U s s l . PUss2) P*ofi( pef E^Bh User

o*'!*^^^ j

1

(3,2,0) (*.D.01

(3,1.1]

j QaiassO

85

aolassl

pclas£2 j

s'o.e..S' O.G -. W = 0,4JS % 0.2 .

_I_

(1.0,5)

-

T' •

(1,1.4)

(U.3}

11,3.2)

A- f

ll-fln-fe-fln-fli-]^--....

(1.4,!)

(1,5,0)

2,0, 4)

(2,1, 3)

(2, 2, 2)

(2. 3, i)

(£, 4,0] 3,C, ( 2|

(3.!, 15

(3.2,0) (VO.O!

Numbei of Users. fCUssO. Classt. CUssZ) j Qteuenue 4 -

1- 1 .

n

(1.0,6)

^

r (1,1.4)

••

-_ (1,2,3)

(i,3,2)

(5.4,1}

(1,5.0)

(2,0.4)

(2,1.3)

(2,2,2)

(2.3.1)

10: 1

(2,4,9)

(3,0,2)

-

acost

--

{3.1.0

OpfoCnj

(3.2,0)

(t.O.O)

Number of i x e r s , ( C l a s s 9 , Clasxl. CUssZ)

Fig. 7. Mean PSNR provided to a customer and profits for the service provider. Users of classO, class J and class2 interact in the VoD system. There are 1, 2, 3 and 4 accepted users of classO.

Figure 6 presents some of the measures that we have calculated when there is no accepted user of classO in the VoD system. This way, the system capacity is 7 users. The results are shown for 7, 6, 5 (from left to right) users in the system. Measures for class2 users are independent of the number of accepted users of classl. These values are almost constant and close to those of maximum quality e.g. PSNR=38dB, Profitj}er_user=Q,A[u\. On the contrary, measures for users form classl are quite degraded when a new user from class2 or classl enters the system. Nevertheless, measures (including profits) for classl are always the same or better than for classl. Figure 7 shows the performance evaluation for the number of users equal to the system capacity when there are 1,2,3 and 4 accepted users of classO (from left to right). We can notice that the PSNR of classl and classl is not much degraded when there is only one user of classO. Nevertheless, when there are 2 users of classl, the system is quite congested producing a notable degradation in the video quality offered to the users of any class. Alternatively, if the capacity of the system is decreased in one user less, the PSNR offered to the users improves, as Fig. 8 shows. Further, the service provider's profits increase in spite of having a user less than before. The reason is that the profit per user is higher than before, i.e. O.Aulclassl, 0.6\i/classl now and 0.3u/classl, 0.2u/classl before. However, a lower system capacity decreases the access probability for new users.

I.V. Martin, Monica Aguilar-Igartua, and Jorge Mata-Diaz

86

Average PSNR

i ^ oisssO a class!

iDiai front

a ciassZ

^«-

--

2,M • ^33§381^37.

J- F f

4 -

-

i:

(S,0,3) (2,1,2) (2,2,1) (2,3.0) (3,0,1) (3,1,0) Numbei of Users. (ClassO. CUssl. ClassZ)

t-

1-

7

|srevpnge D cos I B profit

- -,- - ... - - ;

r.- -— n %

(2,0,3) (2,1,2) (2,2,1) (2,3,0) (3.0,1) (3,1,0) Mumber ot Users. (ClassD. Classl. Class2)

Fig. 8. Mean PSNR provided to a customer and profits for the service provider. There are 2, 3 accepted users ofclassO, (from left to right). Figure 7 clearly shows another undesirable situation. When there is one classO user then the profit per user of classl is higher or faintly lower than the profit per user of classO. Nevertheless, that is unfair because we are providing a lower PSNR to classJ than to classO. This incongruity is due to the fact that RSVr„i„ is higher for classO than for classl i.e. to transmit the coded flow with the same video quality, the service provider has to reserve a higher amount of resources for classO user than for classl user. That affects in the cost for the service provider, which is higher when giving service to users of classO than to users of classl, despite both produce the same incomes. To cope with this, the service provider should charge more to users of classO for that reason, e.g. afixedamount depending on the RSV„ti„.

5

Conclusions and Future Work

Many QoS management frameworks available in the literature need mechanisms and procedures to quantitatively evaluate the user-level SLA parameters. The generic methodology which we proposed in [11] utilizes the characterization of the available constant-quality flows to develop a model for adaptive video-streaming services. Models obtained with this methodology capture the dynamism of the transmitted stream taking into account the interaction among all the users accepted in the system. Employing this methodology, we have obtained evaluations of an adaptive VoD system when several QoS customer profiles are considered. We have assessed some VoD system design options, avoiding operating states where the QoS requirements are not ftilfilled or the efficiency is not suitable. On the other hand, we have estimated the QoS parameters which the service providers could agree with their customers. Also, we have evaluated an adaptive pricing scheme for the customers and its trade-off with the service provider's profits. In particular, we have analysed the service provider's profits when we limit the number of accepted users of each class. As future lines of research, we are analysing another design aspects, such as: the algorithm of segmentation applied on the video sequences stored in the VoD server and different policies to assign resources to each user-class. We are developing general criteria to select the set of coded flows that the service provider will arrange to offer the service.

Design of an Adaptive-Rate Video-Streaming Service with Different Classes of Users

87

References 1. D. Wu, Y.T. Hou, W. Zhu, Y. Zang, and J.M. Peha, Streaming Video over Internet: Approaches and Directions, IEEE Trans, on Circuits and Systems for Video Technology 11(3), 282-300(2001). 2. M. Ghanbari, Video Coding; An Introduction to Standard Codecs (lEE Telecommunications Series 42), lEE Publishing, (1999). 3. L.J. De la Cruz and J. Mata, Performance of Dynamic Resource Allocation with QoS Guarantees for MPEG VBR Video Traffic Transmission over ATM Networks, Global Telecoraunications Conference, IEEE GLOBECOM'99, vol. 2, pp. 1483-1489 (1999), 4. P. Manzoni, P. Cremonesi, and G. Serazzi, Workload Models of VBR Traffic and Their Use in Resource Allocation Policie, IEEE/ACM Trans, on Networking 7(3), 387-397 (1999). 5. G. Cortese, R. Cremonese, P. Fiutem, S. D'antonio, M. Esposito, S.P. Romano, and A. Diaconescu, CADENUS: Creation and Deployment of End-User Services in Premium IP Networks, IEEE Communications Magazine 41(1), 54-60, (2003). 6. 1ST Project: TAPAS- Trusted and QoS-Aware Provision of Application Services, (2001) http://www.newcastle.research.ec.org/tapas/ 7. G.M. Muntean and L. Murphy, A New Adaptive Multimedia Streaming System for All-IP Multi-Service Networks, IEEE Transactions on Broadcasting 50(1), 1-10 (2004). 8. A. Lombardo and G. Schembra, Performance Evaluation of an Adaptive-Rate MPEG Encoder Matching IntServ Traffic Constraints, IEEE/ACM Trans, on Networking 11(1), 47-65 (2003). 9. C. Luna, L. Kondi, and A. Katsaggelos, Maximizing User Utility in Video Streaming Applications, IEEE Transaction on Circuits and Systems for Video Technology 13(2), 141148(2003). 10. R.S. Ramanujan, J.A. Newhouse, M.N. Kaddoura, A. Ahamad, E.R. Chartier, and K.J. Thurber, Adaptive streaming of MPEG video over IP networks. Proceedings 22nd Annual Conference on Local Computer Networks, IEEE, pp. 398-409, (1997). 11. I.V. Martin, J.J. Alins-Delgado, M. Aguilar-Igartua, and J. Mata-Diaz, "Modelling an Adaptive-Rate Video-Streaming Service Using Markov-Rewards Models", Proc. of the First International Conference on Quality of Service in Heterogeneous Wired/Wireless Networks (QSHINE04), IEEE, pp. 92-99, Dallas, Texas, USA, (2004). 12. J.F. Meyer, Performability Evaluation of Telecommunication Networks, in: Teletraffic Science for Cost-Effective Systems, Network and Services, edited by M. Bonnati, ITC-12, pp. 1163-1172, Elsevier Science Publishers B. V. (North Holland, 1989). 13. I.V. Martin, J.J. Alins-Delgado, M. Aguilar-Igartua, and J. Mata-Diaz, Performability Analysis of an Adaptive-Rate Video-Streaming Service in End-to-End QoS Scenarios, 16th IFIP/IEEE Distributed Systems: Operations and Management, LNCS 3775, 157-168 (2005). 14. Y. Bemet et al., RFC 2998: A Framework for Integrated Services Operation over Diffserv Networks, (2000). 15. U. Sarkar, S. Ramakrishnan, and D. Sarkar, Study of long-duration MPEG-trace segmentafion methods for developing frame-size-based traffic models. Computer Networks 44(22), 177-188 2004). 16. Min Wu, R.A. Joyce, Hau-San Wong, Long Guan, and Sun-Yuan Kung, Dynamic Resource Allocation via Video Content and Short-Term Traffic Statistics, IEEE Transacfions on Multimedia 3(2), 186-199 (2001). 17. A. Mashat and M. Kara, Performance Evaluation of a Scene-based Model for VBR MPEG Traffic, Performance Evaluation IFIP WG7.3 36(1), (1999). 18. B. R. Haverkort, R. Marie, G. Rubino, and K. Trivedi (eds), Performability Modelling: Techniques and Tools, (John Wiley & Sons, ISBN: 047149195-0, 2001).

I.V. Martin, Monica Aguilar-Igartua, and Jorge Mata-Diaz 19. R. Vallejos and M. Barria, Evaluation of Moments of Cumulative Reward in Repairable Systems, Universidad Tecnica Federico Santa Maria Technical Report (unpublished), (2005). 20. A.S. Elmaghraby, A. Kumar, M.M. Kantardzic, and M.G. Mostafa, Bandwidth Allocation in a Dynamic Environment Using a Variable Pricing Policy, 7th International Symposium on Computers and Communications (ISCC'02), IEEE, pp. 589-594, (2002). 21. A. Krishnamurthy, T.D.C. Little, and D. Castanon, A Pricing Mechanism for Scalable Video Delivery, Multimedia Systems 4(6), 328-337 (1996).

A Novel Architecture for Utility Driven Management Issam Aib^^, Raouf Boutaba^, and Guy PujoUe^ ^ Networks and Distributed Systems Laboratory, University of Waterloo, Canada, iaib®bcr2.uwaterloo.ca ^ Lip6 Laboratory, University of Paris 6, France Abstract. In this paper, we specify and implement a framework for utility driven generation and scheduling of management actions based on Business context and Service Level Agreements (SLAs). SLAs are compiled into low level management policies; as well as sets of performance metrics and utility functions. These are subsequently used to drive the scheduling of the low level policy actions. Each action is associated with a utility participation value based on parameters relevant to the contract(s) it is related to; as well as the run-time context of its triggering and execution times. A Web hosting company case study is used to illustrate the benefit of taking into account business level implications when scheduling the execution of management tasks. We measure the overall business profitability as a pondered linear function of other business metrics such as overall raw financial profit and overall customer satisfaction. Finally, we discuss the difficulties and challenges related to the correct estimation of utility costs associated with the low level management/control actions. K e y words: Utility Driven Management, Service Level Agreement, Policy based Management

1 Introduction With the increasing number, complexity and frequency of IT related decisions, the mechanisms to determine the optimal utilization of IT resources must become an integral part of automated IT Operations. Given the timescales involved, the decision making process has to be implemented through management rules (policies) whose objective is to maximize the business profit (value) of the services offered by the IT system. We propose a management approach [2] which stems from the observation that however successful an enterprize might be with its adoption of a management solution, it must be remembered that its IT infrastructure is aimed at the provision of a service which is exchanged for economic value. Therefore, it is extremely important to make the low-level management capability clearly

Please use the following format when citing this chapter: Aib, I., Boutaba, R., PujoUe, G., 2006, in IFIP International Federation for Information Processing, Volume 213, Network Control and Engineering for QoS, Security, and Mobility, V, ed. Gaiti, D., (Boston: Springer), pp. 89-99.

90

Issam Aib, Raouf Boutaba, and Guy PujoUe

aware of business level considerations. Low-level configuration and management actions are either triggered by events and system states or manually issued by a system administrator. We consider tfie use of policies to model this behavior reasonable as it does not lure out the generality of our approach. The reason is that any automatic action or rule can aJways fit within the Event Condition Action (EGA) paradigm. Hence, we model the dynamics of an IT system through a dynamic set of EGA rules that govern all of its behavior. Manually enforced actions make no exception as they fall too within the EGA rule set where the event part is something like " admin-decision". In oiir framework low-level configuration and management policies are generated from the set of contracts (SLAs) the IT provider has concluded as well as his own Business objectives and high level management policies. Our study does not concern itself with how these low-level configuration and management actions are actually generated. We are rather interested in how to monetize and maximize the business level utility at run-time through the appropriate scheduling of low level actions. Each action is associated with a utility (or penalty if negative) participation value based on parameters related to the contract (s) it is related to and the run-time context of its triggering and execution times. We compare this new business-level utility-driven scheduling to the default mode which is the simple FIFO execution of actions as soon as they are triggered. We show that our technique would always result in a better performance and more optimized value for the overall Business Profit of the IT provider.

2 Related Work Driving IT management from business objectives is quite a novel proposition. In [6][7], Buco et. al. present a business-objectives-based utility computing SLA management system. The business objective(s) that they consider is the minimization of the exposed business impact of service level violation, for which a high-level solution is presented in [15]. However, the Management by Business Objectives component of the Framework presented in this paper goes far beyond just using impact of service level violations. It provides a comprehensive method for IT management that can take into account strategic business objectives; thereby, going a long way towards the much needed synchronization of IT and business objectives. For a more detailed discussion of MBO capability applied to the incident management domain see [5]. In another respect, the area of SLA-driven management has been closely interested in the subject of SLA modeling. WSLA [10] [11] from IBM research and WSMN [12] [13] from HP Labs analyze and define SLAs for Web Services by building new constructs over existing Web Services formalisms. [13] specifies SLOs within SLAs and relates each SLO to a set of Clauses. Clauses provide the exact details on the expected service performance. Each clause represents an event-triggered function over a measured item which evaluates an SLO and triggers an action in the case the SLO has not been respected. In [4], an FSA

A Novel Architecture for Utility Driven Management

91

(Finite State Automata) is defined for SLA state management in which each state specifies the set of SLA clauses that are active. Transitions between states can be either events generated by an SLA monitoring layer or actions taken by parties in the SLA. Keller A.and Ludwig H. [10][11] define the Web Service Level Agreement (WSLA) Language for the Specification and Monitoring of SLAs for Web Services. The framework provides differentiated levels of Web services to different customers on the basis of SLAs. In this work, an SLA is defined as a bilateral contract made up of two signatory parties, a Customer and a Provider. Service provider and service customer are ultimately responsible for all obligations, mainly in the case of the service provider, and the ultimate beneficiary of obligations. WSLA defines an SLO as a commitment to maintain a particular state of the service in a given period. An action guarantee performs a particular activity if a given precondition is met. Action guarantees are used as a means to meet SLOs. [9] adds on this work by proposing an approach of using CIM for the SLA-driven management of distributed systems. It proposes a mapping of SLAs, defined using the WSLA framework, onto the CIM information model. Finally, [8] considers a direct application of WSLA within UCEs. The GSLA model we propose for SLA specification [1] has the novelty of considering each contracted service relationship as a set of parties playing an SLA game in which each party plays one or more roles to achieve the SLA objectives. GSLA party behavior is captured into a unique semantic component; modeling a role that the party plays. SLOs are specified for each role and enforcement policies are generated to meet them. These policies need not be specified at contract sign time, they can change according to run-time circumstances. Ultimately, roles represent a high-level representation of a set of lowlevel enforcement policies which are generated, enabled, disabled, and removed as a whole and help keep a consistent relationship between what is high-level behavior and its corresponding low-level actions. Finally, the use of policies for the management of utility computing infrastructures has been recently addressed by Akhil et al. [14] from HP Labs where policy is used to assist in service deployment. We consider this component as part of the policy deployment and resource configuration component of the PDP.

3 The Business Driven Management Framework (BDMF) The main objective of the business driven management (BDMF) framework is to drive the management of IT resources and services from the business point of view. Most of the times, when tradeoff-kind of decisions are to be made, the IT managers have a feeling for which is the option available to them that guarantees the minimum cost or least disruption to the service. But unless the impact of carrying out the chosen course of action onto the business layer is understood, one may run the risk of solving the wrong problem optimally. Because of this.

92

Issam Aib, Raouf Boutaba, and Guy Pujolle

the BDMF was designed according to the principle of making information that pertains to the business visible from the IT and vice versa. 'Business Aware Management I New Business Demand/ i Market Trends New Application opportunities New Tedinoiogies I

i t infrastructure resources

i

Fig. 1. The Business Driven Management Framework (BDMF) As presented in fig. 1, the BDM architecture is divided into two main layers. On the top is the business aware layer (BAL), which is intended to host the long term control of the IT infrastructure based on the business objectives and market strategy of the IT provider. Beneath it is a resource control layer (RCL) which hosts the real time logic for the reactive short term control of the IT infrastructure. The Business Management Layer is responsible for optimizing the alignment of IT resources usage with the objectives of the utility provider based on a set of business objectives defined and audited over relatively long periods of time (monthly, quarterly, etc.). Business objectives are the reflection of the utility provider's business strategy and range over diverse key performance indicators, which can be related to service operations, service level agreements, or any other business indicators. Business relationships contracted by the utility provider are formalized by SLAs and modeled using the GSLA information model [1]. Using the GSLA, each contracted service relationship is modeled as a set of parties playing an SLA game in which each party plays one or more roles to achieve the SLA objec-

A Novel Architecture for Utility Driven Management

93

tives. Each role in the SLA is associated with a set of Service Level Objectives (SLOs) to be achieved; as well as a set of intrinsic policies related to the role behavior per see. A special engine, we call the Role-to-policies mapping engine, translates Roles, SLOs and rules into a set of enabling policies. These pohcies are further refined to lower level policies (LLPs) that enclose all the low level logic required to correctly drive the utility resources. Note that the automation of the translation per see is still an open research problem which is out of the scope of this paper. For our use case we use a pre-established mapping between SLA templates and their manually generated enforcement policies. Business objectives affect the way SLAs are defined and managed at the resource control layer. So whenever a business objective is changed, added, or removed, important impact takes place at the long term time scale on the SLA database. Low level pohcies (LLPs) are dealt with by the Policy Decision Point (PDP) module [3] of the resource control layer. Part of the PDP's task is to monitor and respond to system events and notifications by selecting, activating, and scheduling the enforcement of the appropriate pohcies at the appropriate utility resources. The P D P contains also sub-components for policy run-time conflict detection, root cause analysis, generation of the set of options available in the presence of some incident or problem, as well as a the generate of appropriate configuration flows in order to enforce active policies. As it is impossible to define policies upfront to cover all run-time events, it will happen that LLPs may not be sufficient to deal with certain conditions. In those cases, our PDP passes up the control to the BDM. Given the various options, the BDM will select the one that will maximize the value to the utility provider. That is, the option that will result in the closest alignment to the business objectives. Such interactions offer also the opportunity for the architecture to learn and refine the policy repository.

4 A utility computing web hosting use case We consider a Utility Computing Provider, named UCP, which offers web hosting services to client companies. UCP offers a generic SLA template as described in fig. 2. For simplicity, we assume that UCP provides two different web hosting packages each with different QoS assurances and pricing. These are advertised as two SLA types, SLA-Tl and SLA-T2, which are actually instances of the generic SLA of fig. 2. The SLA instances are depicted in table 1. UCP is free to enforce those SLA types the way it wants as long as it is able to meet its customers' requirements. In our case a set of EC A rules (policies) are generated for each SLA type. The detail of this is explained after describing the overall management architecture.

94

Issam Aib, Raouf Boutaba, and Guy PujoUe

C is provided a Web-Server Service vifith schedule SC Capacity is of CP simultaneous connections Initial storage capacity is S GB C is monthly charged $ a x Capacity + b X Storage.initial + c x Storage.Extra.Average Monthly availability of the hosted service will be A% Otherwise, refund C RA% of period PR Any service unavailability will be fixed within at most MinTTR min Otherwise, C will be refunded RMTTR of period RMTTRPR Average time to process any customer service request over a month period wiii be less than ART ms Otherwise, credit C RRT% of period RRTPR IF C fails to pay the monthly charge for Maxfvl successive months the contract becomes void.

Fig. 2. Generic UCP SLA Template Table 1. Template SLA instances of the Generic UCP SLA Param SC CP

SLA-T2 SLA-Tl SC SC 5000 2000 1 0.5 a 0.1 0.15 b 5 5 c 10 10 A 99.9 99 RA 100 100 RAPR month breach period MinTTR 20 oo RMTTR 100 NA RMTTRPR breach period NA ART 200 300 RRT 20 80 RRTPR month month MaxM 6 3

s

It is interesting to notice that the deduction of the appropriate set of parameters and the number of SLA templates UCP desires to offer is a complex issue that depends not only on UCP's IT infrastructure but also on the market state and its evolution. Through simulations, it is possible to get a feeling of which templates it can more "safely" go with. 4.1 B u s i n e s s Metrics Although T l and T2 SLA types (Sec. 4) are specified over two service parameters, namely availability and service latency, they each define different service levels and have different penalties. In our use case, we assume that UCP defines two Business Level metrics as input to it its overall Business Profit Function: RP representing the raw

A Novel Architecture for Utility Driven Management

95

financial profit in some monetary unit, and CS, a measure of overall customer satisfaction. The Business Profit Function ^ represents a measurement of the overall utihty gained and is defined as: 1' = axRP RP^S

^^=

+ (ixCS ^

E

7i

ieTemplateSet

(1)

RP(s)

E

(2)

(3)

GS(s)

s€TlSLASet

a,P,ji, and S represent pondering wheighs that are tunable to reflect the importance the IT operator (UCP) gives to each business indicator (metric). Simulations can be used to determine and tune these values. Customer importance is translated by the existence of pondering factors related to each type of SLA. A more fine grained view of Customer importance involves per customer importance pondering factors. These factors are calculated based on Customer history (profit generated from that customer, service importance, etc.) RP, although it involves a whole computation tree, is relatively easy and more accurate to measure compared to CS. The latter business indicator is less evident to measure as it generally depends on a relatively subjective appreciation of the customer of the overall service performance and might vary from customer to customer even with the same service performance. For the sake of keeping the use case simple enough, we assume that Customer Satisfaction is calculated as follows: For the first month of service usage, customer satisfaction (CS) is measured by the number of experienced service failures with a maximum of %FedUp at the occurrence of which the customer becomes completely unhappy with the provided service {CS = 0). C5i = 1 - -pr^ Min (Nb (SLOFailures), FedUp) r edup On the following evaluation periods, the relationship becomes:

(4)

CSn + l = l3CSn + (1 ~ /3) ^ Min {Nb {SLOFailures), FedUp

FedUpU

(5)

This means that Customer Satisfaction is a pondered sum of the last customer satisfaction experience and the number of experienced Service Failures majored by the predefined threshold FedUp.

96

Issam Aib, Raouf Boutaba, and Guy PujoUe

4.2 Generation of configuration policies In order to enforce each contracted SLA, the utiUty provider translates the set of Service Level Objectives (SLOs) it has to guarantee into a set of access control and management policies that are stored into the policy repository. Given that the UCP Roles-to-policies mapping engine knows that a UCP web server resource instance can serve up to 500 clients without reducing the contracted QoS, we understand from the policy set of Fig. 3 that the UCP considered the "lazy policy" of per-need provisioning to meet its SLAs. Whenever there is a need, an additional web server instance is installed and provisioned for customers. For brevity, we include the generated policy set of SLA-T2. T2-SLA{...Ro\e T2-SLA.UCP-Role{ SL01 = WS.Capacity.Max = "5000" SL02 = WS.Availability.Month.Average.Percent > 99.9%" SL03 = MinTimeToRepair( WS.availability) < 20 min SL04 = WS.SingleRequest.Duration.Month.Average < 200 ms WSThreshold = 80%; WS.Singlelnstanoe.capacity = 200 policy P21= on SLA.Schedule.deployTime do (WS.installNew (WS.Config, WS.Singlelnstance.capacity) policy P22= on WS.installed do ConfigureAccessRights(C) policy P23= on WS.installed do SwitchFabric.AssignQoSTag (WS.TratficID, EF) policy P24= on (WS.Ioad == WSThreshold) do WS.installNew (WS.Config, WS.Singlelnstance.capacity) when (WS.Nblnstances * WS.Singlelnstance.capacity < WS.Capacity.Max ) priority = AboveNormal policy P25= on (Web-Server.lnstanceFailure) do WS.installBackup (WS.Config.WS.Singlelnstance.capacity) priority = 5 (Critical) policy P26= on WS.IoadiWSThreshold-20% do WS.Lastlnstance.free() policy P27= on fail(SL02) do C.Credit(C.Charge) policy P28= on fail(SL03) do C.Credit ( C.Charge * duration(fail(SL03)) / Time.Month.Duration) policy P29= on fail(SL04) do C.Credit ( 0.8 * C.Charge ) policy P210= on fail (C-Role,Policy-1, 6) do TerminateContract ( C-SLA)}}

Fig. 3. Generated SLOs and Policies for UCP-T2 Role

4.3 R u n t i m e conflicts by analyzing the sets of generated policies for SLA-Tl and SLA-T2 it is possible to expect the occurence of runtime conflicts between each subset of elements of the poUcy set {p21,p24,p25,pl2,pl4,pl5}. This happens when the UCP provider accepts to signs as much number of SLA-Tl and SLA-T2 SLAs so as the statistical average of their resource consumption meets the actual available system capacity. Hence, the system needs to work with cases where it might become in shortage of resources. Default priorities between the generated policies will give policies belonging to SLA-T2 priority over those belonging to SLA-Tl. The reason is that SLAT2 customers bring more money per allocated resource and have also more stringent QoS requirements. However, at runtime and depending on the SLO

A Novel Architecture for Utility Driven Management

97

state of each SLA it might happen that at some point in time policies of SLA-Tl instances become more important to execute otherwise their respective SLOs will fail and generate real loss for the provider while if executed to the expense of delaying SLA-T2 policies will not generate penalties as long as there is still time for their respective SLOs to fail. This is an example of a runtime policy conflict which cannot be dealt with at compile time. When the PDP is confronted here with a run-time policy conflict, it needs the assistance of the MBO for a wiser (business-driven) decision as a run-time policy conflict is generally symptom of service degradation that the PDP cannot measure correctly. The PDP hence sends a set of options for the MBO to decide which to apply. The MBO engine will normally take into consideration service and business level parameters related to (i) SLAs (current total time of service unavailability, time to recover from unavailability, penalty amounts, Expectation of the evolution pattern for the number of customers for each SLA (to decide whether to allocate resources or just do not if the congestion period is expected to be temporary); and (ii) Current customers satisfaction indicators. In our implementation, it currently evaluates the impact of SLO failure on the BPF and decides by minimizing the overall impact on it. It is clear that it is not necessarily the FIFO treatment of active policies which will lead to the best business profit. When the PDP knows that there will be inevitably a degradation of service (that might lead or not to some SLO violation) the MBO answers about the best options (strategy) to follow so as to achieve minimal degradation of the business profit function. 4.4 B D M F Simulation Testbed In order to validate our framework, we designed a Java based discrete event simulation system which features the main components of BDMF. The system is composed of three major packages: - A base package of a process-based discrete event simulation system. ~ Package edu.bdmf which implements all the components of BDMF. - A testbed package which actually implements our running example. The edu.bdmf package is the core component of the implementation. It builds on the base discrete process-based simulation package and features the core of a policy based management system supported by the high-level features of BDMF. These include the support for SLA specification according to the GSLA model [1], definition of business objectives; specification of metrics at resource, service and up to the overall business profit function; as well the connection with the BPF maximization (impact minimization) engine by determining which decision making algorithm to apply with regards to the scheduling of active pohcies (actions). The generic SLA (sec. 2) of our running example is implemented as a Java class with the associated attributes as class parameters. The two SLA templates

98

Issam Aib, Raouf Boutaba, and Guy Pujolle

we used are subclasses of it. A similar reuse technique is used in the Roles [1] and policy specifications. For example, policy p21 of SLA template T2 and pl2 (not shown here) of SLA T l are the same and hence specified using the same class. We compare the plain FIFO scheduling method, which launches triggered poUcy actions in the order of their arrival, to the second scheduling method employs a greedy approach to BPF maximization by selecting each time the policy which at the time being is expected to lead to the best positive participation (or least negative participation) to the BPF. The simulation shows no difference between the two techniques as far as the set of available server units has not been exhausted. However, When the system operates in congested conditions either by increasing the number of contracted SLAs or the end customer connection rate, the greedy BPF maximization scheduUng technique shows its power by succeeding to keep the BPF always at a better value than the plain FIFO method. The gain interval tends to reach a maximum value after which the two functions tend to converge to the same loss levels.

5 Conclusion This paper presented the BDMF management framework which extends policybased management with a wider scope decision ability that is informed and driven through the business objectives and the contractual obligations of the enterprise supported by the IT systems being managed. We described prehminary results of the implementation of the BDMF framework on the base of a discrete process-based event simulation system. These include the utility generation and scheduling of management actions based on business context and the set of service level agreements an IT operator has contracted. We used a web hosting company example to illustrate the system functionalities. The use case showed the importance of management actions scheduling for maximizing the business profit function of IT providers. The BDMF simulation environment can serve as a basis for the analysis and validation of policy performance at run time. In addition, our implementation illustrates how class inheritance can serve as a powerful tool to reinforce reusability of SLAs, Roles, and Policies at both template and instance levels. We believe that this work represents a first step towards management actions scheduling and execution based on high level business metrics. As a future work, we plan to further vahdate our framework through simulations using other business level objectives and different scheduling techniques.

References 1. I. Aib, N. Agoulmine, and G. Pujolle. A multi-party approach to SLA modeling, application to WLANs. In Second IEEE Consumer Communications and

A Novel Architecture for Utility Driven Management

99

Networking Conference (CCNC), pages 451 - 455. IEEE, Jan 3-5 2005. 2. I. Aib, M. Salle, C. Bartolini, and A. Boulmakoul. A business driven management framework for utility computing environments. In proceedings of the Ninth IFIP/IEEE International Symposium on Integrated Network Management (IM 2005). IEEE, 16-19 May 2005. 3. E. B. Moore. Policy core information model (PCIM) extensions, rfc 3460, January 2003. 4. C. Bartolini, A. Boulmakoul, A. Christodoulou, A. Farrell, M. Salle, and D. Trastour. Management by contract: IT management driven by business objectives. In P. University of Evry, editor, HP Open University Association (HPOVUA), volume 10. HPL, June 2004. 5. C. Bartolini and M. Sail. Business driven prioritization of service incidents. In Utility Computing: 15th IFIP/IEEE International Workshop on Distributed Systems: Operations and Management, DSOM, volume 3278 of Lecture Notes in Computer Science, pages 64-75. Springer-Verlag GmbH, Jan 2004. 6. M. Buco, R. Chang, L. Luan, C. Ward, J. Wolf, P. Yu, T. Kosar, and S. U, Shah. Managing ebusiness on demand SLA contracts in business terms using the crossSLA execution manager SAM. In ISADS '03: Proceedings of the The Sixth International Symposium on Autonomous Decentralized Systems (ISADS'03), page 157, Washington, DC, USA, 2003. IEEE Computer Society. 7. M. J. Buco, R. N. Chang, L. Z. Luan, C. Ward, J. L. Wolf, and P. S. Yu. Utility computing SLA management based upon business objectives. IBM Systems Journal, 43(1):159-178, 2004. 8. A. Dan, D. Davis, R. Kearney, A. Keller, R. P. King, D. Kuebler, H. Ludwig, M. Polan, Mike, Spreitzer, and A. Youssef. Web services on demand: WSLAdriven automated management. IBM Systems Journal, 43(1):136- 158, 2004. 9. M. Debusmann and A. Keller. SLA-driven management of distributed systems using the common information model. In Proceedings of the VIII IFIP/IEEE IM conference on network management, page 563, 2003. 10. A. Keller and H. Ludwig. T h e WSLA framework; Specifying and monitoring service level agreements for web services. Journal of Networks and Systems Management, 11(1), 2003. 11. H. Ludwig, A. Keller, A. Dan, R. P. King, and R. Pranck. Web service level agreement (WSLA) language specification. Technical report, IBM T.J. Watson Research Center, 2003. 12. V. Machiraju, A. Sahai, and A. van Moorsel. Web services management network: An overlay network for federated service management. In Proceedings of the VIII IFIP/IEEE IM conference on network management, 2003. 13. A. Sahai, V. Machiraju, M. Sayal, A. P. A. van Moorsel, and F. Casati. Automated SLA monitoring for web services. In M. Feridun, P. G. Kropf, and G. Babin, editors, DSOM, volume 2506 of Lecture Notes in Computer Science, pages 28-41. Springer, Nov. 16 2002. 14. A. Sahai, S. Singhal, R. Joshi, and V. Machiraju. Automated policy-based resource construction in utility computing environments. In lEEE/IFIP NOMS, 2004. 15. M. Salle and C. Bartolini. Management by contract. In lEEE/IFIP NOMS, 2004.

Multiobjective Multicast Routing with Ant Colony Optimization Diego Pinto and Benjamin Baran Polytechnical School, National University of Asuncion P.O. Box CC 2111 - Paraguay {dpinto,bbaran}@pol.una.py http://www.fpuna.edu.py/ Abstract. This work presents a multiobjective algorithm for multicast traffic engineering. The proposed algorithm is a new version of MultiObjective Ant Colony System (MOACS), based on Ant Colony Optimization (ACO). The proposed MOACS simultaneously optimizes the maximum link utilization, the cost of the multicast tree, the averages delay and the maximum end-to-end delay. In this way, a set of optimal solutions, known as Pareto set is calculated in only one run of the algorithm, without a priori restrictions. Experimental results obtained with the proposed MOACS were compared to a recently published Multiobjective Multicast Algorithm (MMA), showing a promising performance advantage for multicast traffic engineering.

1

Introduction

Multicast consists of simultaneous data transmission from a source node to a subset of destination nodes in a computer network [1]. Multicast routing algorithms have recently received great attention due to the increased use of recent point-tomultipoint applications, such as radio and TV transmission, on-demand video, teleconferences and so on. Such applications generally require optimization of several quality-of service (QoS) parameters such as maximum end-to-end delay and minimum use of bandwidth resources in a context of traffic engineering. When a dynamic multicast problem considers several traffic requests, not only QoS parameters must be considered, but also load balancing and network resources must be taken into account. In order to avoid hot spots and to balance the network load, a common approach is to minimize the utilization of the most heavily used link in the network (a) or maximum link utilization [2]. At the same time, cost minimization of the tree of each multicast group, which is given by the sum of the cost of the used links, is also desired. It is known that the complexity of computing the minimum cost tree for a given multicast group is NP-hard [3]. Then, this paper presents a new MultiObjective Ant Optimization System (MOACS) [4], which finds a set of optimal solutions by simultaneously minimizing the maximum link

Please use the following format when citing this chapter: Pinto, D., Baran, B., 2006, in IFIP International Federation for Information Processing, Volume 213, Network Control and Engineering for QoS, Security, and Mobility, V, ed. Gaiti, D., (Boston: Springer), pp. 101-115.

102 Diego Pinto and Benjamin Baran utilization, the cost of the tree, the maximum end-to-end delay and the average delay. In this way, a whole Pareto set of optimal solutions can be obtained in only one run of the proposed algorithm. The remainder of this paper is organized as follows. Section 2 describes related works. A general definition of an Optimization Multiobjective Problem is presented in Section 3. The problem formulation and the objective functions are given in Section 4. The proposed algorithm is explained in Section 5 while a brief description of MMA algorithm is given in Section 6. The experimental environment is shown in Section 7 and experimental results are present in Section 8. Finally, conclusions and future works are presented in Section 9.

2 Related work Several algorithms based on ACO consider multicast routing as a mono-objective problem, minimizing the cost of the tree under multiple constrains. In [5] Liu and Wu proposed the construction of a multicast tree, where only the cost of the tree is minimized using degree constrains. On the other hand, Gu et al. considered multiple parameters of QoS as constrains, minimizing just the cost of the tree [6]. It can be clearly noticed that previous algorithms treated the Traffic Engineering Multicast problem as a mono-objective problem with several constrains. The main disadvantage of this approach is the necessity of an a priori predefined upper bound that can exclude good trees from the final solution. In [3], Donoso et al. proposed a multi-tree traffic-engineering scheme using multiple trees for each mulficast group. They took into account four metrics: (i) maximum link utilization a, (ii) hop count, (iii) bandwidth consumption and (iv) total end-to-end delay. The method minimizes a weighted sum function composed of the above four metrics. Considering the problem is NP-hard, the authors proposed a heuristic algorithm consisting of two steps: (1) obtaining a modified graph, where all possible paths between the source node and every destination node are looked for, and (2) finding out the trees based on the distance values and the available capacity of the paths, in the modified graph. Crichigno and Baran [7] have proposed a Multiobjective Multicast Algorithm (MMA), based on the Strength Pareto Evolutionary Algorithm (SPEA) [8], which simultaneously optimizes the maximum link utilization, the cost of the tree, the maximum end-to-end delay and the average delay. This MMA algorithm finds a set of opfimal solutions, which is calculated in only one run, without a priori restrictions.

3

Multiobjective Optimization Problem

A general Multiobjective Optimization Problem (MOP) [9] includes a set of n decision variables, k objective functions, and m restrictions. Objecfive functions and restrictions are functions of decision variables. This can be expressed as: Optimize Subject to where and

y =J[x) = (fi(x),f2{x) ...Jkix)). e(x) = (ej(x), e2(x), ... ,e„{x))>0, x = {xi. X2, ..., x„) e Xis the decision vector, y = (yi, y2, ... . yk) & Yis the objective vector.

Cj-i

Multiobjective Multicast Routing with Ant Colony Optimization

103

X denotes the decision space while the objective space is denoted by Y. Depending on the kind of the problem, "optimize" could mean minimize or maximize. The set of restrictions e{x)>0 determines the set of feasible solutions X/ s X and its corresponding set of objective vectors 1/C- Y. The problem consists in finding jc that optimizes _/(jc). In general, there is no unique "best" solution but a set of solutions, none of which can be considered better than the others when all objectives are considered at the same time. This derives from the fact that there can be conflicting objectives. Thus, a new concept of optimality should be established for MOPs. Given two decision vectors u,veXf: /(«)=/(v)

iff:

Au) (5)

(i,j)sp(s,n)

Using the above definitions, a multicast routing problem for Traffic Engineering may be stated as a MOP that tries to find the muhicast tree T that simultaneously minimizes the following objective functions: 1- Maximum link utilization of the tree: «_

: Maxia,:}

(6)

wherea^. =(^ + /,)/z^.. 2- Cost of the multicast tree: C =
x]

(2)

Table 4. Performance Metrics Metric d97i d97a PA

d97„, P[PA>X]

Description Maximum end-to-end delay in milliseconds observed in the 97"' percentile for the i-th individual VoIP flow. Maximum end-to-end delay in milliseconds observed in the 97* percentile for the aggregate VoIP traffic. Mean of network utilization ratio during interval A, where A is measured in seconds. d97i mean. Probability of PA to be greater than x. (see equation (2)).

Ricardo Nabhen 1,2, Edgard Jamhour2, Manoel C. Penna2, Mauro Fonseca2

4 4.1

151

Simulation Results and Analysis Stage 1: VoIP Traffic

Mean of network utilization ratio during interval A (PA) is a major parameter in simulation and it is obtained as follows: simulation is repeated 20 times for each scenario and we compute the network load given by the input traffic due to the aggregation of independent VoIP sources in intervals defined by A. Figs. 3 and 4 show, respectively, the probability density function and the cumulative distribution function with normalized values for the pi metric observed during stage 1. These graphs represent the results given by all simulations. End-to-end delay values shown later in this section will be presented along with their 95% confidence intervals. One of the main issues to be investigated in this work is the delay experienced by packets under different load conditions and, mainly, how their variation affect this delay. Observing the average network load during the simulation period, i.e., p4oo, in scenarios 1, 2, 3 and 4, respectively, 40.74%, 50.21%, 55.58% and 64.86%, and considering the overprovisioning rule, these values were supposed to be adequate for supporting delay sensitive applications. However, in all scenarios, we can observe the network utilization rate given by pi above 90%, which could affect considerably the end-to-end delay of individual VoIP flows^. In fact, when computed for smaller intervals (A), PA reaches unacceptable values which sometimes could represent a SLA violation. From Fig. 4, for example, one can observe that the probability of p, to be higher than 90% is, respectively, 0.41%, 2.28%, 7.02% and 20.00% for scenarios 1, 2, 3 and 4. We can conclude that it is meaningless to discuss the mean of network utilization rate without taking into account the interval in which it is computed (A). Figs. 5, 6, 7 and 8 show the frequency distribution (normalized values) of d97i for scenarios 1,2,3 and 4, where end-to-end delay axis has been plotted on a logarithmic scale. d97i is computed by considering all values registered in all simulation repetitions, that is, 1600, 1800, 2000 and 2400 VoIP flows for scenarios 1, 2, 3 and 4. The vertical line in each graphic depicts the maximum end-to-end delay observed in the 97th percentile for the aggregate VoIP traffic (d97a). In all scenarios we can see several VoIP flows where d97i is greater than the d97a. This result can be justified by the strategy of grouping all packets of every individual flow in order to compute the 97' percentile of the aggregate traffic. In this context, it is important to mention that either d97a or d97i are computed using the same data set. Using this grouping scheme, it is clear that the 97* percentile of the aggregate traffic is below the 97* percentile of some individual flows (i.e., flows that ocurred during higher load conditions) and, therefore, their d97i are expected to be higher than the associated d97a.

^ Values of network utilization rate above 100% means that the arrival process is higher than the service process given by the output link. Thus, for such periods packets are buffered waiting for service.

152

Analysis of Individual Flows Performance for Delay Sensitive Applications

06

0.9

' Network uafeabon

Network Utilization

Fig. 3.

PI

- PDF

•,6

^e

d97(™trK; d97dmetrt

tv

1 4

Fig. 4. p, - CDF

d97lmewc d97atretliC

1

I

0.6

^11

03

1 1

-

1 i

i 0.2

V...

0 0

iD

1

3

,/

5 ei

1/

01

C01

Fig. 5. d97i -Frequency Distribution - Sc. 1

t ^0 end-to-end delay (ms)

m

1000

/!

1 5

3L

iJi V '0

;oo

Fig. 7. d97i -Frequency Distribution- Sc.3

^,.l.,-.^l.,

..-L-.--.

icon

ICCO

end-to-end delay (ms)

4.2

1 j

Fig. 6. d97i -Frequency Distribution - Sc.2

li c.i

;

\ I

erri-to-end delay (ms)

0G1

\

C4

\

0.2

if

06

1

1CC00

10COi»

end-to-erd delay (rrs)

Fig. 8. d97i -Frequency Distribution- Sc.4

Stage 2: Mixed VoIP and Data Traffic

The difference between stage 1 and stage 2 is that we have mixed data traffic with VoIP flows to generate background traffic. We calculated the same performance

RicardoNabhenl,2, Edgard Jamhourl, Manoel C. Penna2, Mauro Fonseca2

153

metrics, only for packets of VoIP flows. Figs. 9 and 10 show the normalized values for PI frequency distribution observed during stage 2. Here we can observe higher average network utilization rates than those observed in stage 1. The calculated values for p4oo (A= simulation time) in scenarios 1, 2, 3 and 4 are 55.65%, 61.12%, 64.87% and 75.29%, respectively. However, when comparing Figs. 4 and 10, we observe more instances of higher values of pi in stage 1 than in stage 2. This explains the better results even under higher average network utilization rates observed in stage 2. Figs. 9, 10, 11 and 12 show the frequency distribution of the d97j for scenarios 1, 2, 3 and 4 as explained before. As in stage 1, in all scenarios we can see several VoIP flows where d97j is greater than the d97a.

0,4 Networi< uoteatlon

Fig. 9. p, - PDF

u

C5

Network Utili^atnn

Fig. 10. p,-CDF

HJlllliinil, iHlMILIi snd-tD-aid delay (ms)

Fig. 11. d97i -Frequency Distribution ~ Sc. 1

end-to-end delay (ms)

Fig. 12. d97i -Frequency Distribution - Sc.2

154

Analysis of Individual Flows Performance for Delay Sensitive Applications

'

S.2-

v.! 2

d971 metric d97a metre

cB7ametr

—

0.1 i'M

1

A

c.t

c

••

1

J

-

G.oa

0.06

•

0 04

5 02

_M1M_ 00

10

0 ^OOO

ernJ-to-eod delay (ms)

ICOOO

erct-lo-end delay (ms)

Fig. 13. d97i -Frequency Distribution- Sc.3

4.3

-

J

Fig. 14. d97i -Frequency Distribution- Sc.4

Remarks

Tables 5 and 6 present the computed values for d97n, and a97 metrics in each scenario, along with their 95% confidence intervals. Also, the corresponding values of P[pi > 100%] and p4oo are presented. For scenarios 1 and 2 of both stages the P[pi > 100%] is almost negligible. As can be seen, the end-to-end delay remains very steady under these load conditions. In addition, due to the similar value of P[pi > 100%], the scenario 3 in Table 6 also showed an acceptable performance in terms of the d97m metric and its variability (i.e., the 097 metric). This behavior cannot be seen in scenario 3 in Table 5, where a slightly increase of P[pi > 100%] (i.e., to 2.39%) caused a sensible variation of the d97m and a97 metrics. Finally, the scenario 4 of both stages experienced a significant increase of the network utilization rate, easily noted in the values of P[p] > 100%] in Tables 5 and 6, causing exponential augment of the d97i and 097 metrics to prohibitive levels. Table 5. Stage 1: d97n, ; a97 ; P[p, > 100%] metrics Sc.

d97„

Confidence Interval (95%)

a97

1 2 3 4

1.46 3.90 81.50 1000.84

[1.27; 1.64] [3.40; 4.39] [73.00; 89.99] [903.57 ; 1098.10]

3.48 9.78 176.46 2202.51

P[p, > 100%] 0.31% 0.97% 2.39% 9.82%

P400

40.74% 50.21% 55.58% 64.86%

Table 6. Stage 2: d97„ ; 097 ; P[pi > 100%] metrics Sc. 1 2 3 4

d97^ 7.11 8.64 16.63 504.06

Confidence Interval (95%) [6.43 ; 7.80] [7.82 ; 9.46] [14.93 ; 18.33] [457.44; 550.68]

a97 10.05 12.06 24.86 684.52 '

P[p, > 100%] 0.56% 1.06% 1.23% 7.34%

P4(KI

55.65% 61.12% 64.87% 75.29%

Ricardo Nabhenl,2, Edgard Jamhourl, Manoel C. Penna2, Mauro Fonseca2

155

It is important to examine the values in Tables 5 and 6 in light of the frequency distribution of the PA. For example, p4oo is 64.86% in scenario 4 of stage 1 and 75.29% in scenario 4 of stage 2, but d97m was twice higher in the former case which can be explained by the PDF of pA. It is clear from the analysis of Figures 3 and 9 that in stage 1 (see Figure 3) the system remains under higher load conditions which affects directly the overall delay performance given by d97n, and a97 metrics, regardless of the fact that the value of p4oo could indicate the contrary. On the other side, in the scenarios under lower network utilization, this anomaly does not verify, what clearly indicates the importance of considering the network utilization distribution in the context of individual flows performance.

5

Conclusion

This paper presented a study in order to investigate the end-to-end delay behavior observed by individual flows. It is important to understand this behavior and its relation with aggregate traffic and network utilization, mainly when one considers the SLA management for delay sensitive applications. In order to perform this analysis, this study has considered delay requirements for VoIP applications, which defines a maximum end-to-end delay to be experienced by the 97* percentile of packets from each individual VoIP flow. New metrics were defined to evaluate empirical relations between network load and delay of individual flows. Empirical relations were established by an extensive two stage simulation experiment, with multiple scenarios simulating several traffic configurations and a multiplicity of load conditions. Results confirmed that network utilization ratio is one the parameters that affect the most the delay in IP networks. Moreover, the study presented a new approach to relate network load with delay. It is shown that it is meaningless to consider the mean of network utilization rate without taking into account the interval in which it is computed. Analyzed scenarios indicate that even when the average network utilization rate observed is acceptable, for example under overprovisioning empirical rules, the delay performance observed by several individual flows is impracticable. This new approach suggests that any statement about network utilization rate should also state the time interval in which it is computed, mainly when one considers the SLA specification based on individual flows performance metrics.

References 1.

S. Blake, D. Black, M. Carlson, E. Davies, Z. Wang, and W. Weiss, RFC 2475: An architecture for differentiated service. IETF (1998).

2.

A. Westerinen, J. Schnizlein, J. Strassner, M. Scherling, B. Quinn, S. Herzog, A. Huynh, M. Carlson, J. Perry, and S. Waldbusser, RFC 3198: Terminology for policy-based management. IETF (2001).

3.

W. Rhee, J. Lee, J. Yu, and S. Kim, Scalable quasi-dynamic-provisioning based admission control mechanism in differenfiated service networks. ETRI Journal, 26(l):22-37 (2004).

156

Analysis of Individual Flows Performance for Delay Sensitive Applications 4.

R. Liao and A. Campbell, Dynamic core provisioning for quantitative differentiated service. IEEE IWQoS (2001).

5.

Z. Zhang, D. Zhenhai, and Y. Hou, On scalable design of bandwidth brokers. BICE Transactions on Communications, e84-b(8) (2001).

6.

C. Bouras and K. Stamos, An adaptive admission control algorithm for bandwidth brokers. Third IEEE International Symposium on Network Computing and Applications(NCA) (2004).

7.

V. Elek, G. Karlsson and R. Ronngren, Admission control based on end-toend measurements. IEEE INFOCOM (2000).

8.

L. Breslau, S. Jamin and S. Shenker, Measurement-based admission control: What is the research agenda? IEEE IWQoS (1999).

9.

F. Kelly, P. Key and S. Zachary, Distributed admission control. IEEE Journal on Selected Areas in Communications, 18:2617-2628(2000).

10. C. Filsfils and J. Evans, Deploying diffserv in backbone networks for tight sla control. IEEE Internet Computing Magazine(2005). 11. C. Fraleigh, F. Tobagi, and C. Diot, Provisioning ip backbone networks to support latency sensitive traffic. The 22nd Annual Joint Conference of the IEEE Computer and Communications Societies, Infocom(2003). 12. Y. Jiang and Q. Yao, Impact of fifo aggregation on delay performance of a differentiated services network. The International Conference on Information Networking, ICOIN (2003). 13. P. Siripongwutikom and S. Banerjee, Per-flow delay performance in traffic aggregates. Proceedings of IEEE Globecom(2002). 14. Y. Xu and R. Guerin, Individual Qos versus Aggregate Qos: A loss performance study. IEEE/ACM Transactions on Networking, 13:370383(2005). 15. ITU-T (2003). Recommendation g.ll4: One-way transmission time. ITU-T. 16. C. Boutremans, G. lannaccone and C. Diot, Impact of link failures on voip performance. Proceedings of NOSSDAV Workshop (ACM Press) (2002). 17. Cisco. Traffic analysis for Voice over Ip. Cisco Document Server (2001). 18. K. Claffy, G. Miller and K. Thompson, The nature of the beast: Recent traffic measurements from an internet backbone. Proceedings of rNET'98 (1998). 19. C. Dovrolis, D. Stiliadis and P. Ramanathan, Proportional Differentiated Services: Delay Differentiation and Packet Scheduling. IEEE/ACM Transactions on Networking (2002).

Proportional Service Differentiation with MPLS Joao Neves, Paulo Rogdrio Pereira, Augusto Casaca INESC ID, Rua Alves Redol, 9. 1000-029 Lisboa, Portugal. Phone: +351-213100345. Fax: +351-213145843. Email: {Joao.Neves, Paulo.Pereira, Augusto.Casaca)@inesc-id.pt

Abstract. This paper describes two traffic engineering techniques for implementing proportional differentiated services based on Multiprotocol Label Switching constraint based routing. Both use a dynamic bandwidth allocation scheme to modify the bandwidth reserved by each traffic class according to the current network load. The first scheme uses an adaptive algorithm that qualitatively determines the required average throughput per source for each class and moves bandwidth between classes for each path as necessary. The second scheme mathematically divides the existing bandwidth through the traffic classes for each path. The quality of service that users get with both techniques is assessed by simulation and compared with a fixed bandwidth allocation scheme.

1

Introduction

Quality of service (QoS) has been a major research topic in the networking community for the last 20 years [1]. Different user applications have different QoS requirements. Depending on the user application, parameters such as end-to-end delay, jitter, packet loss and throughput may be critical. The simplest answer to provide the QoS that the user applications need is to increase the capacity of the links. This is known as overprovisioning and results in a waste of resources, especially for end-to-end QoS. The Differentiated Services architecture [2] offers a scalable solution for providing end-to-end QoS. Packets from different user applications with different QoS requirements are classified into different traffic classes and marked accordingly. Only ingress edge routers perform classification, marking and policing functions. The network core only deals with the aggregate of flows in each traffic class, giving them a common queue or scheduling behavior. This allows a scalable service differentiation according to the traffic class.

Please use the following format when citing this chapter: Neves, J., Pereira, P.R., Casaca, A. 2006, in IFIP International Federation for Information Processing, Volume 213, Network Control and Engineering for QoS, Security, and Mobility, V, ed. Gaiti, D., (Boston: Springer), pp. 157-169.

158

Joao Neves, Paulo Rogerio Pereira, Augusto Casaca

However, if a fixed bandwidth allocation is used for each traffic class, a priority inversion may occur when a high priority class has higher load than a low priority class. A possible solution is to use flow admission control to avoid this situation. It has the disadvantage of refusing the requested traffic class to flows that would degrade the QoS of existing flows. Although the admission control is necessary to limit the maximum total network load and avoid QoS degradation, if the network resources in the core devoted to each traffic class are made to depend on the actual load of the traffic classes, fewer flows will see their traffic class changed by the admission control. Towards this objective, the paper proposes two kinds of dynamic bandwidth allocation schemes based on traffic engineering (TE) techniques for implementing differentiated services supported by Multiprotocol Label Switching (MPLS) constraint based routing (CR) [3]. MPLS uses a label switching technique that consists in the addition of a label to each packet. This label indexes a forwarding table in each router, determining the outgoing link and the new label to use. The processing involved can be made much faster than looking at the destination address in the packet as in a routing process. Constraint-based routing (CR) is a mechanism used to meet Traffic Engineering requirements. It allows for a path to be setup based on explicit route constraints, QoS constraints and other constraints. The use of MPLS-CR was selected because it allows reserving and dynamically modifying the bandwidth in a path between a network core ingress and egress node. It can be used to configure the bandwidth, as necessary, for every traffic class in each path of the core network. The first scheme proposed in this paper uses an adaptive algorithm that determines the required average throughput per source for each traffic class, according to the current network load, and moves bandwidth between classes for each path in the network core as necessary. The second scheme proposed in this paper mathematically divides the existing bandwidth through the traffic classes for each possible path in the network core according to the current network load. We propose to use an Olympic service model with three traffic classes; Gold, Silver and Bronze. We propose also to use a proportional differentiation mechanism between the Gold and Silver classes to give the Gold class the best QoS. The Bronze class is a best effort class that gets a very small fraction of the existing bandwidth along with the unused bandwidth of the other classes. This nomenclature is slightly different from the Olympic service nomenclature proposed in [4]. A proportional differentiation mechanism [5] is a refinement of a differentiated services mechanism, where an adjustable and consistent differentiation between classes is provided. The proportional differentiation has the advantages of being controllable, consistent and scalable. The proportional differentiation mechanism should try to give to each Gold flow the double of the bandwidth as to each Silver flow. This factor of two was chosen arbitrarily, as an example. In practice, it should depend on the relation of the prices charged to clients in the different classes. The Gold and Silver classes could be further divided according to the specific QoS needs of the applications. For simplicity, we assumed that all applications have similar QoS requirements, except for the transport protocol used. TCP applications tend to increase their transmission rate until there is a packet loss, which should not

Proportional Service Differentiation with MPLS

159

affect the transmission rate of UDP applications. Accordingly, we propose to have different classes for TCP and UDP traffic, resulting in four MPLS-CR reservations: Gold TCP, Silver TCP, Gold UDP and Silver UDP. Both proposed dynamic bandwidth allocation schemes were analyzed by simulation and compared with a fixed bandwidth allocation scheme for the QoS that users get. Section 2 describes the dynamic bandwidth allocation schemes. Section 3 describes the simulation scenario and the simulation results. Finally, section 4 draws conclusions and raises further work topics.

2 Dynamic Bandwidth Allocation Schemes 2.1

Adaptive Dynamic Bandwidth

In the first dynamic bandwidth allocation technique proposed, an adaptive algorithm divides the bandwidth between the traffic classes according to a few rules that determine when the reserved bandwidth should be moved from a traffic class to another. First, a value for the required throughput per source (TpS) is determined. This is done independently for the Gold and Silver classes and for the UDP and TCP protocols. The TpS values are tabled, as shown in table 1, using steps that become smaller as the number of sources in a node increases, so as to accommodate the throughput of all the sources in a given path. The required TpS for the Gold class is about twice the TpS for the Silver class, favoring the Gold class for higher loads, so that the QoS is higher for the Gold class. The values chosen depend on the characteristics of the sources that were used.

Table 1. Throughput per Source (TpS) values according to the number of sources Number of Sources

Gold Class

Silver Class

up to 4

100 Kbps

50 Kbps

5 to 8

50 Kbps

25 Kbps

9 to 10

40 Kbps

20 Kbps

11 to 12

30 Kbps

15 Kbps

13 or more

25 Kbps

10 Kbps

If the total bandwidth required for a class, determined as (TpS x number of sources), is higher than what is currently reserved with MPLS-CR, the dynamic algorithm searches in all the links of the path if it is possible to increase the reserve, considering the sources of the different paths sharing the same links. If possible, the reserve for the path is increased. If not possible, the algorithm will try to decrease the reserves of other paths. The Silver class is always the first one to be decreased, even

160

Joao Neves, Paulo Rogerio Pereira, Augusto Casaca

if the predefined TpS steps for the Silver class are not respected. The Gold class is only decreased if the TpS allows it. If no decrease is possible, the bandwidth remains unchanged, which usually happens with high congestion. For all classes, there is always a minimum bandwidth guaranteed, considering the number of existing sources. 2.2

Mathematical Dynamic Bandwidth

In the second dynamic technique, a mathematical approach to divide the bandwidth among the classes is used. The idea is that the bandwidth available per source, for the Gold class should be twice the bandwidth available per source for the Silver class. The bandwidth available per source is related to the QoS users get. The corresponding expressions are: bwColdTCP + bwSilverTCP + bwGoUUDP + bwSilverUDP = TOTALbw bwGoUTCP ^ bwSilverTCP NrSourcesGoldTCP NrSourcesSilverTCP bwGoldUDP ^ bwSilverUDP •2xNrSourcesGoldUDP NrSourcesSilverUDP bwGoldTCP bwGoldUDP NrSourcesGoldTCP NrSourcesGoldUDP The first expression says that the total available bandwidth in a link has to be divided through the 4 existing aggregated flows, one for each combination of the existing classes with the different application protocols. The 4 aggregated flows follow the same source-destination path, whose bottleneck bandwidth is given by the value TOTALbw. This restriction does not exist in the adaptive algorithm. There are also fixed fractions of the link bandwidth that are reserved for signaling and best effort traffic, both excluded from the above expressions. The second expression says that the bandwidth per Gold TCP source should be twice the bandwidth per Silver TCP source. The factor of two was chosen as an example of QoS proportionality between the Gold and Silver classes. The bandwidth per source is determined by dividing the total bandwidth of the aggregated flow by the number of flows existing in the aggregated flow. If the TCP applications continuously generate traffic, this expression results in the throughput QoS parameter for each Gold TCP flow to be twice as in the Silver TCP class. The third expression is similar for the UDP protocol: the bandwidth per Gold UDP source should be twice the bandwidth per Silver UDP source. This usually results in a better QoS (lower delays, jitter and loss) for the Gold class. The fourth expression says that each flow should get the same bandwidth, whether it is using TCP or UDP. Only the class should influence the QoS, not the protocol chosen. Solving these equations, we get the bandwidth allocation for each class, corresponding to the reservations to be made in the network, as:

Proportional Service Differentiation with MPLS 161 TOTALbw X NrSourcesSilverUDP bwSilverUDP •• l.NrSrGoldTCP + NrSrSilverTCP + l.NrSrGoldUDP + NrSrSilverUDP NrSourcesSitverTCP bwSilverTCP = bwSilverUDPxNrSourcesSilverUDP NrSourcesGoldUDP bwGoldUDP = IxbwSilverUDPx NrSourcesSilverUDP NrourcesGoldTCP bwGoldTCP = 2x bwSilverTCP X NrSourcesSilverUDP The mathematical algorithm periodically modifies the bandwidth reserved for each source-destination path, according to these expressions.

3 Simulations and Results 3.1

Network Configuration

The network topology used for the simulations is shown in figure 1. The network has a core containing 12 nodes with at least 5 link-disjoint paths between each pair of nodes. This allows for some redundancy, so that there are several alternative paths between each source-destination pair that can be used by traffic engineering. Additionally, there are 3 ingress routers and 3 egress routers where traffic sources and traffic sinks are placed. The core links were configured with 1 Mbit/s capacity and 2 ms delay. Since we only wish to study the behavior of the core, the access links were configured with a sufficient large capacity. The network topology is described and discussed in [6]. It was simulated in the NS2 network simulator [7].

Fig. 1. Network topology

Three types of traffic sources were used simultaneously: long lived FTP/TCP sources, constant bit rate (CBR) sources over UDP and Pareto On/Off sources over UDP. Sources are randomly generated with equal proportions of the three traffic

162

Joao Neves, Paulo Rog^rio Pereira, Augusto Casaca

types. Therefore, there might be paths more congested than others in some simulations. Paths are reserved in the core through MPLS-CR for each pair of sourcedestination nodes. The Bronze class has no paths reserved through MPLS. For Gold and Silver classes, there are 2 classes x 2 protocols x 3 source nodes x 3 destination nodes = 36 aggregated flows mapped onto MPLS reservations. All these aggregated flows are created initially. The dynamic bandwidth allocation schemes only modify the MPLS-CR bandwidth reservations for each path as necessary. 3.2

Fixed Bandwidth

The fixed bandwidth scenario is used only as a term of comparison in this paper. It divides the bandwidth along the classes as follows: 30% for Gold UDP, 30% for Gold TCP, 15% for Silver UDP, 15% for Silver TCP, 1% for signaling and 9% for Bronze. These values were chosen so that at least 10% of the bandwidth is available for the best effort traffic, the Gold class has the double of the bandwidth of the Silver class and the UDP and TCP classes have the same bandwidth available. Naturally, these values should depend on the services sold by the Internet Service Provider and the expected traffic pattern. But, in this scenario, they are fixed, whatever the actual traffic pattern is, while in the following two scenarios, they change according to the two algorithms proposed. From the different simulations performed, the most interesting case is the one where the number of Gold class sources increases with a fixed number of 6 Silver sources and 60 Bronze sources. The results for the three different types of traffic sources (FTP/TCP, Pareto/UDP, CBR/UDP) are shown in figures 2, 3 and 4, respectively. Several simulations runs were made with different random number seeds and the same number of traffic sources. The results presented correspond to the average of the different simulations. Throughput FTP 200000 180000 160000

\.

140000 120000 -.-Gold

100000

.

80000

Silwr Bfonze

60000 40000 20000 0 10

15

20

25

30

35

40

45

50

55

60

Nr. Gold Sources

Fig. 2. FTP throughput per source for fixed bandwidth scenario

The results show a priority inversion between the throughput for the Gold and Silver classes for high loads: the fixed bandwidth available for the Gold class is

Proportional Service Differentiation with MPLS

163

divided by a large number of sources, resulting in less throughput per source and worse QoS than for the Silver class. Throughout Pareto 100000 90000 80000 70000 60000 50000 . - Silver

40000

.

Bronze

30000 20000 10000 0 6

10

15

20

25

30

35

40

45

50

55

60

Nr. Gold Sources

Fig. 3. Pareto throughput per source for fixed bandwidth scenario

Throughput CBR 100000 90000 80000 70000 60000 -Golb

50000

Silver

40000

Bronze

30000 20000 10000 0 6

10

15

20

25

30

35

40

45

50

55

60

Nr. Gold Sources

Fig. 4. CBR throughput per source for fixed bandwidth scenario

As the order in which the MPLS-CR paths between sources and destinations are created influences the paths chosen, two orders are used. The first possibility is to create first the UDP paths for Gold and Silver classes and then the TCP paths for Gold and Silver classes. This will enable that several paths with different source-destination pairs share links in the core. This possibility was used in the adaptive algorithm. The second possibility is for all source-destination pairs, no matter what their class or protocol, to use the same path. This will enable a better division of the bandwidth between the different classes. This possibility was used in the mathematical algorithm.

164

Joao Neves, Paulo Rogerio Pereira, Augusto Casaca

The first possibility results into a slightly worse delay and jitter for TCP flows, as they use the longest paths. Otherwise, there are no significant differences in the QoS. 3.3

Adaptive Dynamic Bandwidth

In the first dynamic technique, an adaptive algorithm moves bandwidth between the traffic classes, as necessary. Figures 5, 6 and 7 show the throughput with this technique for the same situation as in figures 2, 3 and 4. Throughput FTP 120000 100000 80000 — Gold S .a

^ Silver

60000

.

Bronze

40000 20000 0

6

10

15

20

25

30

35

40

45

50

55

60

Nr. Gold Sources

Fig. 5. FTP throughput per source for the adaptive dynamic technique

Throughput Pareto 100000 90000

• • • ,

80000

"*—•——-.-.^^

70000

~^~""~^~~-^__-—.

60000

~^Gold

60000 40000 30000

*

"

Silver

•» Bronze

.

20000 10000 0 10

15

20

25

30

35

40

46

60

56

Nr. Gold Sources

Fig. 6. Pareto throughput per source for the adaptive dynamic technique

Now there is no priority inversion for the throughput of FTP and Pareto applications, as the load increases. However, as a certain minimum bandwidth is assured to each class, the throughput variation is small as the load increases. This minimum bandwidth assured for the Silver class still causes a QoS priority inversion

Proportional Service Differentiation with MPLS

165

for high loads on the Gold class for CBR traffic. Although this priority inversion is a disadvantage from the proportional differentiation point of view, it might make sense, depending on the service being sold to users, since a minimum assured bandwidth is also of some value to users. The mathematical algorithm removes this minimum, as it does not use any steps. For the FTP sources, the relation between the Gold throughput and the Silver throughput is 1.8 on the average, not far from the configured value of 2. But for the other types of sources, the relation is far from 2 on the average. The other QoS parameters (end-to-end delay, jitter and packet loss) will be analyzed in section 3.5, so that all proposed techniques are evaluated together for these parameters and compared to the fixed bandwidth scenario. Throughput CBR

10

15

20

25

30

35

40

45

50

55

60

Nr. Gold Sources

Fig. 7. CBR throughput per source for the adaptive dynamic technique

3.4

Mathematical Dynamic Bandwidth

In this second dynamic technique, the existing bandwidth is divided between the traffic classes according to the proposed mathematical expressions. Figures 8, 9 and 10 show the throughput with this technique for the same situation as in figures 2, 3 and 4. Now there is a better proportionality between the QoS in the Gold and Silver classes, with an increased throughput for low loads as compared with the adapfive algorithm. For the FTP sources, the relation between the Gold throughput and the Silver throughput is 2.4 on the average, not far from the configured value of 2. For low loads, the Silver class is not much loaded and gets more than half the throughput of the Gold class. For high loads, there are many packet retransmissions, lowering the Silver class throughput. For Pareto and CBR sources, the proportionality is not so easily obtained, but the Gold class always gets better QoS. For low loads, all Gold and Silver source applications can transmit all their packets, so the throughput is similar for both classes. When the load increases, the Silver class is much more affected than the

166

Joao Neves, Paulo Rogerio Pereira, Augusto Casaca

Gold class. The relation between the Gold throughput and the Silver throughput is 2.2 on the average for the Pareto sources and 1.9 for the CBR sources. The other QoS parameters (end-to-end delay, jitter and packet loss) are analyzed in the next section. Throughput FTP 300000

r-

250000 200000 i 150000

N

V

V ~ Sil«r

1

.. Bronze 100000 •

-

-

.

.

50000 0

10

15

20

25

30

36

40

45

50

55

60

Nr. Gold Sources

Fig. 8. FTP throughput per source for the mathematical dynamic technique

Throughput Pareto

10

15

20

25

30

35

40

45

50

55

60

Nr. Gold Sources

Fig. 9. Pareto throughput per source for the mathematical dynamic technique

3.5

QoS Comparison

Figure 11 shows the end-to-end delay averaged over the different types of user applications, for the different algorithms, for the Gold class on the left and for the Silver class on the right. The evolution of the remaining QoS parameters (jitter and packet loss) is very similar to the evolution of the delay, so they are not shown. The conclusions are the same as for the delay.

Proportional Service Differentiation with MPLS

167

Throughput CBR 80000 -, 70000 60000 50000 -Gold Silwjf Bronze

40000 30000 20000 10000 0 10

15

20

25

30

35

40

45

60

55

60

Nr. Gold Sources

Fig. 10. CBR throughput per source for the mathematical dynamic technique

Average end-to-end delay for Gold Class

Average end-to-end delay for Silver Class

—•—Rxed **

Adaptive

>" „ .

« . •

15

20

25

30

35

40

45

50

55

6

10

15

..#...

••

"^

20

Nr. Gold Sources

25

30

35

.m

....... *

..m.„.

"~-«" ' —•—

* ^ • 10

-

' 40

45

50

55

60

Nr. Gold Sources

Fig. 11. Average end-to-end delay for the Gold and Silver classes

From figure 11, it can be observed that the end-to-end delay for the Gold class with the mathematical algorithm has a similar evolution as in the fixed bandwidth scenario, but with smaller values, resulting in better QoS. On the other hand, the endto-end delay for the Silver class with the mathematical algorithm increases much faster as the load increases, when compared with the fixed bandwidth scenario. This means that the mathematical algorithm moves bandwidth from the Silver to the Gold class, increasing the Gold QoS and degrading the Silver QoS, when the load on the Gold class increases. As regards the adaptive algorithm, the end-to-end delay for the Gold class is about constant when the load increases, while the end-to-end delay for the Silver class degrades much more slowly than for the mathematical algorithm. The mathematical algorithm offers better QoS to the Gold class, but for high loads, the QoS of the Silver class is better for the adaptive algorithm, as it assures a

168

Joao Neves, Paulo Rogerio Pereira, Augusto Casaca

minimum bandwidth to the Silver sources, independently of the load in the Gold class.

4 Conclusions and Further Work This paper proposes and evaluates two techniques for implementing proportional differentiated services based on MPLS-CR. The results show that with both techniques proposed it is possible to improve the QoS users get, as compared with the situation of fixed bandwidth division. The results show that the mathematical technique makes a more uniform division of the bandwidth, according to the number of existing sources, resulting in a better overall QoS and better proportional differentiation of the throughput. The main restriction to the mathematical approach is that the paths for the same source-destination pair need to be always the same for all the protocols and classes, otherwise the value for the TOTALbw in the equations will not make sense, since it will not correspond to one path but to several ones. On the other hand, the adaptive algorithm does not have that kind of restriction and paths can be randomly created. However, in these simulations we had a concern which was to put a Gold and a Silver class aggregate in the same path in order to make it easier for the Gold class to get the needed bandwidth. The results also show that the difference between Gold and Silver QoS is not always proportional, but the aim is to guarantee a TpS according to the number of sources in the path. If the path is equally shared by both classes. Gold flows should usually get twice the QoS Silver flows get. As regards the signaling traffic required for modifying the bandwidth reserved for the paths, the mathematical technique provides new values for the reservations for every flow that starts or stops, while the adaptive technique works in steps and requires fewer modifications. The development of a technique to keep the signaling traffic within a certain limit, say 1 % of the network capacity, was left for further study. The removal of some simplifications was also left for further study. These include: the use of other network topologies; the simultaneous use of sources with different QoS requirements; the use of different proportionality factors between the Gold and Silver bandwidths; and the use of multiple paths for each sourcedestination pair.

References [1] S. Giordano, S. Salsano, S. Van den Berghe, G. Ventre, D. Giannakopoulos, "Advanced QoS Provisioning in IP Networks: The European Premium IP Projects", IEEE Communications Magazine, 41(l):30-36, January 2003. [2] S. Blake, D. Black, M. Carlson, E. Davies, Z. Wang, W. Weiss, "An Architecture for Differentiated Services", IETF RFC 2475, December 1998.

Proportional Service Differentiation with MPLS

169

[3] B. Jamoussi, L. Andersson, R. Gallon, R. Dantu, L. Wu, P. Doolan, T. Worster, N. Feldman, A. Fredette, M. Girish, E. Gray, J. Heinanen, T. Kilty, A. Mails, "Constraint-Based LSP Setup using LDP", IETF RFC 3212, January 2002. [4] J. Heinamen, F. Baker, W. Weiss, J. Wroclawski, "Assured Forwarding PHB Group", IETF RFC 2597, June 1999. [5] Y. Chen, C. Qiao, M. Hamdi, D. Tsang, "Proportional Differentiation: A Scalable QoS Approach", IEEE Communications Magazine, 41(6):52-58, June 2003. [6] P. Pereira, P. Lepera, A. Casaca, "DiffServ Traffic Management with MPLS", 5* Conference on Telecommunications, Confrele'2005, Tomar, Portugal, April 2005. ISBN: 972-98115-9-8. [7] UCB/LBNL/VINT Network Simulator (version 2). http://www.isi.edu/nsnam/ns/

A Model of Signaling for Establishing of LSPs for Multicast Communication over GMPLS Networks Rafael P. Esteves', Antonio J. G. Abelem', Ewerton Vaz^ and Michael A. Stanton^ 1 Federal University of Para, Department of Informatics Rua Augusto Correa, 01, 66075-110, Belem, Para, Brazil {esteves, abelem}@ufpa.br WWW home page: http://vvww.cultura.ufpa.br/abelem 2 Federal University of Para, Computer Science Graduate Program Rua Augusto Correa, 01, 66075-110, Belem, Para, Brazil [email protected] WWW home page: http://www.ufi3a.br/ppgcc 3 Fluminense Federal University, Institute of Computing Rua Passo da Patria, 156, bloco E, sala 350, 24210-240, Niteroi, RJ, Brazil [email protected] WWW home page: http://www.ic.uff br/~michael/

Abstract. Label switching, which in IP networks is exemplified by MPLS and its extensions MPLambdaS and GMPLS, appears as one of the best alternatives to offer a reliable and flexible control plane for WDM networks, since it allows the integration of the IP Protocol with WDM technology, when lambdas are associated with labels, implements powerful traffic-engineering mechanisms, and provides several alternative schemes for fault-tolerance, as well as support for quality of service (QoS). However, almost all the definitions and standardizations for MPLS are restricted to unicast communication, leaving support for multicast communication for future work. In the specific case of the triggering problem for LSPs (Label Switched Paths), there is still no consensus about the best strategy for multicast communication. This paper proposes an algorithm for traffic-driven triggering of LSPs, based on MFCs (Multicast Forwarding Caches), and has the advantage of being a schema which is compatible with several multicast routing protocols. To validate the proposed algorithm we carry out simulation studies using the NS-2 (Network Simulator) simulation platform.

Please use the following format when citing this chapter: Esteves, R.P., Abelem, A.J.G., Vaz, E., Stanton, M.A., 2006, in IFIP International Federation for Information Processing, Volume 213, Network Control and Engineering for QoS, Security, and Mobility, V, ed. Gaiti, D., (Boston: Springer), pp. 171-186.

172

1

Rafael P. Esteves, Antonio J. G. Abelem, Ewerton Vaz and Michael A. Stanton

Introduction

The increasing demand for sophisticated network applications, allied to the growth of the Internet traffic, has lead to great efforts in the search of improvements in data transmission technologies with the intention of satisfying the increasing demand for bandwidth. So far as optical networking is concerned, WDM (Wavelength Division Multiplexing) appears as the main advance in the transmission area, because it allows transmission rates near to the theoretical limit of optical fibers, of the order of dozens of terabits a second [1]. An essential issue in optical network design is defining how the network will be controlled, that is, what type of signalling will be responsible for resource reservation, route determination and fault handling, among other functions that constitute the control plane. Label switching, which in IP networks is exemplified by MPLS (Multiprotocol Label Switching) [2], was extended through GMPLS (Generalized Multiprotocol Label Switching) [3] to operate with several different network technologies, where the label can be represented in other ways, for example, as time-slots in TDM networks, as physical switch ports and as wavelengths (lambdas) in WDM networks. GMPLS appears as one of the best alternatives to offer a reliable and flexible control plane for WDM networks, since it allows the integration of the IP Protocol with WDM technology, when lambdas are associated with labels, implements powerful traffic-engineering mechanisms, and provides several alternative schemes for fault-tolerance, as well as support for quality of service (QoS). However, almost all the definitions and standardizations for MPLS are restricted to unicast communication, leaving support for multicast communication for fliture work. In muldcast based on label switching, the establishment of a label-switched path (LSP) can be made in three ways [4]: request-driven, topology-driven or trafficdriven. However, there is no consensus on which is the best alternative, since all three present pros and cons. In a similar way, controversies exist about the type of control to be adopted in multicast communication (independent or ordered) and about the method for distributing labels for a certain equivalence class, which can either be initiated by the egress LSR of the link, using the on-demand or unsolicited approaches, or by the ingress LSR of the link, using the on-demand, unsolicited or implicit approaches [4]. Thus we may conclude that a great opportunity is presented to analyze and reformulate some aspects of multicast communication and its use in a label switching context. The objective of this paper is to propose an algorithm for the traffic-driven triggering of LSPs based on MFCs (Multicast Forwarding Caches), which are structures derived from the multicast routing tables found in the implementations of IP multicast (DVMRP, PIM), with the purpose of obtaining a scheme which is compatible with several implementations of multicast routing protocols. Basically, in this approach, when a node needs to create an entry in an MFC to store information about multicast groups, an LSP request is sent and processed by all the nodes in the direction of the source node. To validate the proposal, simulations were carried out using the NS-2 {Network Simulator) simulation platform.

A Model of Signaling for Establishing of LSPs for Multicast Communication over GMPLS Networks

173

As our proposal is related to label-switching in a general way, it can be associated, in addition to MPLS, to the improvements developed to bring label switching to the next-generation networks, such as GMPLS. In addition to this introductory section, the paper is organized in more 4 sections. Section 2 discusses the characteristics of existing LSP triggers, presented in the literature. The algorithm for establishing LSPs is described in Section 3. Section 4 presents the simulation experiments used to validate the proposed algorithm. Section 5 presents conclusions and proposals for future work.

2

Triggering Multicast LSPs

One of the main discussion points concerning the use of label switching for multicast communication is the choice of method to be used to establish the label-switched paths. Ooms et al. [4] define three approaches to this task: request-driven, topologydriven and traffic-driven. In the request-driven approach the label advertisement messages are encapsulated in control messages of the multicast routing protocol, such as Join messages, or in RS VP messages. This approach takes advantage of the characteristics of existing routing protocols, but can require that such protocols include explicit control messages, such as in PIM-SM, restricting its applicability to this class of protocol. The encapsulation of label advertisements in native control messages of the multicast routing protocol is usually referred as ''piggy-backing". This method has some problems, such as the fact that it excludes dense-mode protocols, since these do not use explicit control messages, and the modifications needed to add these messages to the protocol would be very expensive. Piggy-backing also makes impractible the use of other approaches to LSP triggering, as well as requiring extensions to the routing protocol to handle other LDP (Label Distributon Protocol) fiinctions, such as peer discovery, and contributing to an increase in control traffic. The topology-driven approach maps a level 3 multicast tree to a level 2 tree. The disadvantage of this is that labels are consumed even if there is no traffic for a certain multicast tree. Traffic-driven LSP triggering has the advantage of consuming less labels than the other methods, because LSPs will only be established if there is demand for traffic. To achieve this, the technique monitors data structures known as MFCs (Multicast Forwarding Caches). MFCs are subsets of multicast routing tables that store information relating only to multicast groups that handle traffic [5]. If no entry exists in the MFC for a given multicast packet, one will be created. If the routes change afterwards, the MFC will be updated. MFCs are used in most IP multicast implementations in UNIX systems and, as they are kept in the kernel of the operating system, traffic-driven triggering can be used with several different multicast routing protocols, making this approach more attractive than the alternafives. Although these different approaches have all been proposed, a detailed definition of their mechanisms is needed, and some of them are not compafible with all existing

174

Rafael P. Esteves, Antonio J. G. Abelem, Ewerton Vaz and Michael A. Stanton

multicast routing protocols. In this paper we describe an algorithm to establish LSPs based on traffic-driven triggering, since this approach has the advantage of being compatible with several multicast routing protocols and also consumes fewer labels than other multicast LSP triggers.

3

3.1

An Algorithm for LSP Establishment for Multicast Communication Based on MFCs Reference Model

The reference model used in this article consists of IP/MPLS (we will use the MPLS term to refer to MPLS and its extensions MPXS and GMPLS) routers connected by means of an optical internetwork, using dynamically switched lightpaths (Fig. 1). The optical networks composing this internetwork are based on OCS {Optical Circuit Switching) [6] and MPLS paradigms. The choice of OCS is due to its low complexity, and, consequently, low implementation cost compared with other optical switching paradigms. On the other hand, the choice of MPLS, as pointed out in Section II, is justified by its flexibility and support for traffic engineering, as well as its being extensible to work with WDM technology, with the use of wavelengths as labels.

Fig. 1. Model network used in this proposal, composed of multiple optical switching devices (LSC) interconnected by an optical mesh. We assume that the optical internetwork consists of a number of optical networks, each of which might be operated by a separate administrative entity. Each optical network can be made up of subnetworks comprised of a number of optical switching devices capable of label switching (Lambda Switching Crossconnects LSCs) and interconnected by some non-specific topology of optical links. For simplicity, we assume there exists a one-to-one mapping between WDM switches and their IP-addressable controllers. Signaling in an optical internetwork is performed out of band, and uses just one (high capacity) signaling channel (or lambda) per fiber. Signaling messages are

A Model of Signaling for Establishing of LSPs for Multicast Communication over GMPLS Networks

175

electronically processed by all nodes, including internal ones. Data packets are not processed at internal nodes, and we make no assumptions about the data transmission rate. Network intelligence is concentrated essentially at the network edge, and no global synchronization is required. We fiirther assume the use of the integrated control model, as presented in [7], where both the IP and optical domains are managed in a unified way, with a single routing protocol and a single control plane based on MPLS. In the case of the internetwork consisting of a single Autonomous System (AS), a single intradomain routing protocol will be considered. When several ASs are involved, an interdomain routing protocol will also have to be used. Both intra- and interdomain routing protocols need to include the necessary extensions for optical technologies. We also consider that all devices run IP Multicast and that optical devices have full light-splitting capability. The equipment must support both level 2 (MPLS) and level 3 routing. 3.2

Description of the proposed algorithm

In this section we describe an algorithm for traffic-driven LSP triggering. Our purpose is to detail the actions needed to establish LSPs, using as few resources as possible. The algorithm works as follows: Every time a node receives a multicast packet, it verifies if there is information about the destination in the multicast forwarding cache (MFC). If this information is not found this node requests the creation of an entry in this structure. When a leaf node (a node that is a destination of the multicast data) needs to request an entry in the M F C it acquires a label (Label can be represented by a wavelength in a

MPXS/GMPLS context) for itself and propagates to the previous node on the route from the source the following information; the label to be used and the FEC (Forwarding Equivalence Class) of the LSP that is being built. This same information will be used to create entries in the LIB (Label Information Base) of the node. The LIB in each LSR (Label Switched Router) stores data that will later be used in label-processing. A LIB entry usually contains the following fields: FEC, incoming label, incoming interface, outgoing label and outgoing interface [8]. The label sent will be used by the previous node (following the traffic direction) on the label swapping operation, that is to change the incoming label value with the outgoing label value (the incoming label of the next hop towards the leaf-nodes). An intermediate node will also assign a label, create a LIB entry and forward this informafion along the path to the previous node in a similar way. The multicast traffic source node does not request labels because it gets them from the downstream nodes belonging to the multicast tree. When an intermediate node needs to replicate packets, it will receive several labels for the same equivalence class from the outgoing interfaces of the multicast distribution tree. If this happens, the node creates the additional entries in the LIB with the same FEC and the same incoming label. Fig 2. illustrates the algorithm. This upstream signaling approach was designed to guarantee that all the nodes along the path have labels for a given FEC. The FECs are associated with the traffic

176

Rafael P. Esteves, Antonio J. G. Abelem, Ewerton Vaz and Michael A. Stanton

source in this approacli, in other words, the packets that originate at a given node and belong to the same multicast group also belong to a single FEC. It is worth pointing out that in this approach a single FEC is associated with several LSPs that have a common source. To initiate this LSP triggering process, traffic has to arrive at a leaf node belonging to a multicast group. This data forwarding demands level 3 routing, since there is still no LSP to route these packets at level 2, therefore, the devices used in this approach must support this fiinctionality.

Data Flow

Data replicalion. Additional entries are created in LIB Table

^

^

^

D.la source

Labels are ^ I sent towards (2) the souree

Intermediate ncxie requests labels

(D

Labels are 4sent towards I ttie souree IjJbsIs are sent towards (2) the source MFC entry request (Group A)

.' 'rC entry

'equest ^Group A) Leaf-node requests labels

® Leaf-node requests labels

Fig. 2. Proposed algorithm for LSP triggering. We now describe the format of the LIB entries created by the algorithm for each type of node (leaf, intermediate and source). On LSP triggering a LIB entry at the leaf node is created using the following format: Table 1. LIB entry for a Leaf Node

FEC Source node identifier

Incoming Interface Next upstream node

Incoming Label Requested at this moment

Outgoing Interface -1

Outgoing Label -1

A Model of Signaling for Establishing of LSPs for Multicast Communication over GMPLS Networks

177

FEC: The forwarding equivalence class that is associated with the source node in this case. Incoming Interface: Defines where the traffic that arrives to that node comes from, that is, the next upstream node in this case. Incoming Label: The incoming label consists of the label that is assigned by this node. It is requested at this moment, because this parameter will be forwarded to the upstream node to guarantee the creation of a consistent LSP between the leaf node and the data source. Outgoing Interface: Represents the next hop of the packets. Here the value -1 is used because this is a leaf node, and there is no downstream node. Outgoing Label: It represents the new value of the label. Here the value -1 is defined because it is a leaf node. As the signaling messages reach intermediate nodes, the one of more entries are created in each of their LIBs, using the following format: Table 2. LIB entry for intermediate nodes FEC Source node identifier

Incoming Incoming Label Interface Upstream node Requested at this moment

Outgoing Interface Next downstream node

Outgoing Label Incoming label of the next downstream node

FEC, Incoming Interface and Incoming Label are interpreted and defined in a similar way to the leaf node. Outgoing Interface: It is defined with the identifier of the next node towards a certain downstream leaf node, where an LSP was already triggered. Outgoing Label: Defined with the value of the incoming label corresponding to the next downstream node in Outgoing Interface. If this node is a data replicator, additional similar entries are created in the LIB with the same incoming interface and label but different outgoing interfaces and labels. When the signaling message reaches the source node, one or more entries will be created in its LIB with the following format;

Table 3. LIB entry for the source node FEC Source node identifier

Incoming Interface -1

Incoming Label -1

Outgoing Interface Next downstream node

Outgoing Label Incoming label of the next downstream node

178

Rafael P. Esteves, Antonio J. G. Abelem, Ewerton Vaz and Michael A. Stanton

FEC, Outgoing Interface and Outgoing Label are interpreted and defined as shown in Table 2. Incoming Interface: Here the value -1 is defined since, because it is the source node, there is no further upstream node. Incoming Label: Here the value -1 is defined because it is the source node.

4 Validation and Analysis of the Proposed Mechanism 4.1

Tools Used

In order to analyze the proposed signaling and to verify its applicability, simulations were carried out using the NS-2 {Network Simulator) platform. NS-2 [9] is a discrete event-oriented simulator for computer networks much used by the scientific community for analysis and validation of proposals, having as a main attraction an extensible architecture that can easily incorporate new functionality. NS-2 has modules for label switching, MNS {"MPLS Network Simulator") [10], and for WDM optical networks simulations based in lambda (circuit) switching, OWNS {"Optical WDM Network Simulator") [11]. It also supports multicast communications through the implementation of dense-mode protocols (PIM-DM, DVMRP), sparse-mode protocols (PIM-SM) and shared trees. OWNS is an extension module for NS-2 that allows simulation of WDM networks that use circuit switching, also known as lambda switching. It also has components as optical switching nodes, wavelength multiplexed links, and routing and wavelength assignment algorithms. MNS adds MPLS simulation capabilities to NS-2, including some characteristics as label switching, support for LDP and CR-LDP protocols, flow aggregation and constraint-based routing, and it allows the use of some LSP protection and restoration techniques. The version of NS-2 used in this study was 2.1b6, because it has better compatibility with the NS-2 extensions, OWNS and MNS, that are fundamental for the required simulation context. However, these modules do not cooperate with each other, and they do not support multicast communication. Therefore, the simulation of the proposed LSP triggering mechanism demands the following preliminary conditions: • The integration of OWNS and MNS modules, described in detail in [12] [13], which enables us to characterize the GMPLS architecture, where the labels are associated with wavelengths (lambdas). It is worth pointing out that GMPLS adds new functions to the existing ones in MPLS: however, in our case, the other characteristics of GMPLS were not implemented, as we just needed the mapping between labels and lambdas and the ftinctionalities already defined in the MNS module. • Modifications and adaptations to extend the previously developed combined WDM-MPLS structure, to add support for multicast communication, including the development of replicators that can handle labels and the implementation of the proposed algorithm. Boudani and Cousin [14] have proposed a simulation tool based on

A Model of Signaling for Establishing of LSPs for Multicast Communication over GMPLS Networks

179

NS-2 that implements multicast communication in MPLS networks. However, this latter proposal is limited to the PIM-SM multicast routing protocol, which distributes labels through explicit signaling, using Join messages, while our proposal works with several protocols since it implements the traffic-driven LSP triggering. Fig. 3 shows the NS-2 node structure developed to support multicast transport in networks with label switching.

N * * entry

WL«ngth Logk ,

Fig. 3. NS-2 node structure developed for simulations The LOCS classifier is the union of the MPLS node classifier and the WDM node classifier belonging to MNS and OWNS respectively. The classifier is responsible for forwarding the packets to the appropriate simulation object, such as an agent that simulates a transport protocol. In addition to this new classifier, we have built a structure (Wavelength Logic) that keeps the information on the wavelengths allocated in each link in accordance with the established LSPs, using for this purpose the MPLS Label Information Base (LIB). In the part of the node that deals with multicast communication we have added a new replicator, the GMPLS replicator, that produces several copies of incoming information and sends the copies to its outgoing interfaces. The replicator object is essential to implement the multicast communication in NS-2. The actions taken by this node when receiving a data packet are described below: 1. When a packet arrives at the node entry point, it is analyzed to check whether or not it is addressed to a multicast address.

180

Rafael P. Esteves, Antonio J. G. Abelem, Ewerton Vaz and Michael A. Stanton 2.

If it is a multicast packet, then it is forwarded to the Multicast Classifier, that, in its turn, sends the packet to the appropriate GMPLS replicator. Otherwise, the information is sent to LOGS Classifier. 3. If the next hop IP address is of this node, then the packet is passed on to the Port Classifier, to determine which agent will be responsible for handling the arriving information. 4. Otherwise, the packet is sent to the next node through the optical links using label switching. The label switching mechanisms in the new node works as illustrated in Fig. 4.

•

Is the 'N, packet ^, latjeled ? , /

\ Label \ Swapping /

-